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Insider Threat 

® Anyone with legitimate access to 
information, technology, facilities, or 
1 personnel 

■ • Access is used to provide sensitive/classified 
information to an unauthorized person 

Or " 


> Access is used to degrade operations or 
capabilities 



Who Are the Insiders? 

m 

- 1 

® Over 4 million US clearance ! 

1 m ■ . I 

holders .. ;;:y -> 

® 860,000 have fop Secret ' 

Clearances - - 

® 10.000 locations across the 

u3 

!• - 

® How many people have access to 

proprietary or restricted 
information? 



Categories of Threats 

Ui ® Spills : 

- Mishandling, careless, too much info on social 
f 1 networking sites 

• ! ® Leaks 

I - Wiki, media, bloggers. Twitter, media friends 
® Espionage 
- Traditional spy 
©Sabotage 

- Cyber, physical damage, damage to the 
ii- reputation •: 


„ J&SS? 







It Doesn’t Matter Where the Loss 
Occurs . jllll 
® Classified information could be 
compromised at any location: 

• Military installation 

• US Government facilities 

• Cleared Defense Contractors 

• Research facility 

• College/University 


® “WikiLeaks” 

■'r’Y/i&rS''- 




? This Isn ’t Just a CfiRroblem 

' ■ ■ 

Foreign governments, terrorist organizations, 
organized crime rings, drug' cartels, etc., all want 
to Know: 


< Who is the EB1 Investigating? Cases 
© Whal is the ESI doing? operations 
v How does the FBI, do It? Methods 
<* What can ttto EBJ do? CapabMiesfUmUations 
<■• What does tho FBJ know?. Intelligence • 
ft Who Is helping the FBI ? Sources 
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Insider Threats Requires Team Effort ^ 

• ■ - 'ill 

® Counterintelligence ;ssp« >sf^| 

® Security ' ? 

• IT Security 1 

® HR 

® General Counsel 
® Risk Management (if applicable) 

• • ■■ . 11 • ‘ < > .V 1 K*?>£ 



Why? - 

y ' ..*"4 . 

1. Divided Loyalty 

2 . Disgruntled • : 


111 



3. Ego 

• \ r ' v\: 

4. Financial Gain 




3 





6/12/2014 






4 



6/12/2014 


Espionage indicators (confd) 




. 6. Bringing unauthorized recording devices 
(thumb drives,' cameras, cell phones) 

; . into work areas 'v - - fS-* ■ 

7. Unnecessary photocopying of classified 
materials 

8. Unexplained/Unreported foreign travel 

9. Unreported foreign contacts 

10. Unexplained affluence .. . '& .. . 

; 11. Bragging ; about what they kno wMSiafl&l 
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Technology and Logistics 

- mn 

© Because of technological advances, 

, ithe logistics of stealing information 

* ■ have changed 

• . • 64 gigabyte USB drive holds a semi 

• truckload of pages (approx. 4 million pages 
- of MS Word docs) 



• ' No longer need to touch the information to 

l^stealfcopy/photograghjp* 

Sit.* lha riel/r r\f irl" noluinrl/p 


mWM Imagine the risks of "cloud” networks 


Why So Serious? g.y 

® Why do Insiders pose such' a great risk? 

• Access /S - . 

• Quality or quantity 

o Robert Hanssen vs. WikiLeaks 

• They know what is most valuable 

• IT Security looks for hacks/intrusions from 



^iSIHide in plain sight 



.. - 

• . ft • 



(T/F) Since this information is NOT classified 
can share it with anyone. • x 

(T/F) Because of where I work, I am a potential 
target for Espionage/Economic Espionage?; 

"ft ■ • §: 

(T/F) He/she is here in the U.S., so it doesn’t is 
matter if we talk about unclassified information;?;:)? 


(T/F) Exports are always products 
overseas. 
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The FBI Recognizes That; 


kSVjff' 


^ vV'Vi 


® Knowledge knows no 
% boundaries ', 

=4r-:. ■ 

® Global competition is 
beneficial 


® The flow of information is 



Exports: Defined " X 

® Transfer of Anything to a “Foreign Person” 
or a fbreigntocation by anyftieans;;^ 
anytime^ anywhere, or a transfer'to a “U.S. 
Person” when there is a knowledge that the 
items will be given to a “Foreign Person” 


a,. T 


Export Controls 

® Several types of export controls: 

• Export Administration Regulations (EAR) - Dept. 

;W: of Commerce: ifDual-use' - 

-1; • !nternattop.a|ga||c in Arms RegulatiOi\S(ITAR) 

- Dept.of State:' Defense articles.’seglces; etc. 

• Arms Export Control Act ^ " 

• International Emergency Economic Powers Act 
(IEEPA)- Economic and trade sanctions 





FunciamehtalResearah: Defined 


&0M 

mmm 


® Basic and applied research in science and 
engineering, the results of which ordinarily 
are published and shared broadly within 
the scientific community, as distinguished 
from proprietary research and from 
industrial development, design, production, 
and product utilization, the results of which 
ordinarily are restricted for proprietary or 
national security reasons. 


NSDD189 


.1: 



Fundameiit'al'Reseai'ch Exclusion M 

• 

® Does NOT apply if the language of the 
contract: 

• Forbids the participation of foreign persons; 

• Gives the sponsor or the other party to the 
agreement a right to approve publications resulting 
from the research; or 

• Otherwise operates to restrict participation in 

research and/or access to ana disclosures : 
research results;': ^ 

: ..//t. ■ p '-,s' - ' 

® Both basic and applied research can be 
subject to export controls depending on the 
funding source and other delineated 
restrictions in place in a research cgntractWnK- 


Better to- Be Safe 


® Contact before sharing any information 
that may be restricted, including: 

• Security Office 

• Export Control Office 


Sharing includes: publications, emails, 
presentations, conversations, transfers, or any other 
exchanges of information ' 


® Export control is complex! Ask an expert. 

• Protect yourself 

• Protect your job 

• Protect your country 
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Penalties 


® Failure to comply with U.S. export 
.... control laws can result in severe 
^penalties that can inclucle.the following: 

; ^ -r‘ i.- 

• Civil penalties up to $500,000 for each violation; 

;VV" ' 

■ Criminal penalties up to $1 ,000,000 for each 
Violation; and/or 

• Imprisonment for up to 1 0 years 





. T’ie,Chaige . . 

® : :Setween’January 2004 and’May 2006, Roth and AG 
1 engaged in a conspiracy to transmit export -controlled 
; ' technical data related to a restricted U.S. Air Force i 
contract to develop plasma actuators for a munitions- 
: type UAV, or “drone,” to one or more foreign nationals, 
including a citizen from the People's Republic of China, 






Information = $ 

® “Because that’s where the money is." - 
Willie Sutton on why he robbed banks. 

• Information is the new currency 

• You' are the new “banks’- 

® Be thankful you are a target 

• An organization with no information or ideas to 
protect has no reason to exist 

• Our information/ideas are what separate us from 
our competitors 

• And it gives YOU a job! 
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When Traveling 


<$> Don’t take anything you don’t need 

• Information - including personal Information 

• Electronic device* -'Smart phone* + foreign travel = dumb Idea 
. • Extra credit cards 

■ ■ * : ; 

Assume that everything you take with you will be searched , 

All Information on computer*’ phone*,' electronic media, and in 
L document* will be taken/copied ' v 

; iSXpr’* ' Do not leave your thing* unattended: bag*, electronic device*, drinks 

'S ’ Obey local laws/customs 

• Don't get caught In a compromising positon 

• ® Be wary of people you meet 
-_,j •. International date line 

' You have no expectation of privacy while there ^ 



Need to Know 


® Each of us practice “need to know” 
everyday in our private lives 
... • Bank account numbers . -Vy 

a 

. i'.' '^Social security numbers . 

.vii'M 

® Make sure someone has a need to know 
about your research before you share any 
information with them 
• Don't just take (heir word for it -*gfS 

j 







WtjgR&D? 

, 'C'-' -‘Vj * * . , '■'*/$?&'’- ; •; 

®; .Research and Development (RSD)^^> ■; 

■ ..Expbnslve 

• Time & labor Intensive 

• ’Cutting edge* 

• Biggest potential payoff - new technologies, markets 

© Anywhere we have an advantage 

• Not Just military technology 

• . Could be anything from growing food to weather simulation to 
advanced weapons 

© Failures & dead ends U-y 2.. 

.f^ofjhe easy problems were solvedjong ago 


• '•" '. ♦^That leaves the difficult problems * j§|Wfvsu£. 
‘ y More dfficuh * mor* •xpenslv* . ^ ' 
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OPSvrs Strategic and Operational Plan 1 

® In the interests of our national security., . .all 
employees shall be: , " 

v. £ Reliable "T , 

' : ^Trustworthy 

• Of good conduct and character 
<» Of complete and unswerving loyalty 
to the United States 



Adjudicative Guidelines . 

® For Determining Eligibility for Access to 
Classified Information (12/29/2005) 

• Allegiance to the U.S. 

: ^Foreign Influence/Preference .. . 

• j»is"exual Behavior 

• Personal Conduct 

• Financial Considerations 

• Alcohol Consumption/Drug Involvement 

• Psychological Conditions 

• Criminal Conduct 

• Handling Protected Information 

• O utside Activities 

• Use of Information Technology Systems 
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Drug involvement 


<s> Roderick Ramsey (part of the Clyde Conrad spy 
ring) recruited at least two other soldiers to 
participate In espionage: . . .. 

... ■ ' '*§$*<' 
• ; :jho^cople‘thot I recruited, yes. they y/ere^^ , 
invbWe&Tn drugs, but it wasn't so much thaf they '- 
were'pot’smokers or hashish smokers that made 
them; in my opinion, moro susceptible to the " r • 4 
pitch. It was that these were people who had. 
already shown a propensity or willingness to 
violate Army regulations. 

Anyone In the Army who was willing to take ; ; 
drugs on a regular basis has to be willing to take 
some kind of risk and has 1o be svilling to break 
the Army's regulations. That's the starting point 





b7E 
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^|§| 

® Often will approach targets with lucrative t/5: 
job offers overseas 
• Consulting 

^ • Private Investigations . . jjp.:# 

T‘ • Security related '?« . ' 



blE 
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pPM's Strategic and Operational Plan' { |||| 



■ ® In the interests of our national'security....al 
employees shall be: 

• Reliable 

• Trustworthy 

• Of goodconduct and character 

• Of complete and unswerving loyalty 
to the United States 











Jlfe" : '• : •' 

r Factors 'oiConcem 




® Extent of classified access 
® Intelligence officer/foreign government 
official contact 

® Foreign.cbntacts and travel particularly if 
!$■[ ■ unreported; • • ■'•’■S0V 

® Furtive removal of classified material 


m. 


Your Mission: , 

Should you choose to accept it: w 

® You will perform checks on more people 


V*i*’’&* 


Ft? 


®. You will have less time :: 

® You will be limited in the questions you can 






l|i©eciypu^^ 

U are the 1 st Line of 







^ I 

I 

I 


-Wjfiat you can cfo,,.. 


® Get names in original language 
® Finances (Determine if there are any issues) 

• It is difficult to live/work overseas for years without a 
foreign bank account 

® Ask for details on foreign organizations, including: 
■. • Name of organization in English and original language 
Purpose of the organization 

. S*. Membership in the organization -4'’ 

• • Foreign intelligence services often use organizations as 
" cover, or for spoiling/assessing 
® Follow up on foreign contacts (contact info) 

• Includes: email contacts, social networking contacts, etc. 
® Contact with foreign intelligence/police/security 

• FIS often use police 



(fyou suspect something, Flag it 
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Glenn Shriver 

v • . - ■ ■ , - 

.. ' ® Studied in Shanghai - 2002-2003 
;S' ; ®' Moved to PRC’-/esponded to ad 
® Contacted by Chinese IOs 
® Took DoS FSO exam twice/applied to CIA 
® Guilty plea 10/2010 (Conspiracy to transmit NDI) 
® 4 year sentence 

® PRCEMB spokesman - The PRC states it “never 
engages itself in activities that’ll harm other . 
countries’ national interests, and it is sincere in 
developing Sino-U.S. relations of mutual be 







mmssal 


UP 

What are we currently seeing? 

® More applicants from foreign countries 
J : applying for IA or SA positions 
• Applicants lived/worked overseas 
®. Dates in applicationsflot matching 
.:,®. Applicants marrying to gain citizenship e - 


• ® Close family membersliving in a foreign 
country ? 

® Unreported foreign contacts 
® Lack of verifiable information 


HHHii 





i 
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VS.Sffi — “ 



Ellery Systems 

® Software company in Boulder, CO - 1994 
• Andrew WANG (PRC) and Jing CUI (PRC) 



' Stole Source Code 


• Put Ellery Systems out of business, source code 
ended up in China. 


in the News 


• 


;,® Examples of Economic Espionage/Theft of 
Trade Secrets:,:.; .J . 

■ v 

• Wen Chyu “David" Liu - Dow Chemical 

• Michael Mitchell - DuPont 
Meng Hong -DuPont 

• Shalin Jhaveri- Bristol-Myers Squib 
Hanjuan Jin -Motorola 

. Sergey Aleynikov, Goldman Sachs]: sj/V 

• David Lee- Valspar 'ft- 

• Dongfan “Greg" Chung - Boeing 


■■iM- 




- 



5 

?are 4 d : Defense Contractor 



ncerns 

*■» : . % 

ryC'V.* 

m ' 




Thief vs. Competitor vs. Adversary < 

fc T „. , . - Ml/:- --si! 

t ® Thief: * M- . t * ■ 

SA-XJ-VM 

ii 

m 

i: • Wants the money/materials that you have now 





® Competitor: 


m 

r • Wants what you will have in the future 

E\ © Market share, ■ ■ . 



|a. v Jobs . & t •_ ' : 

m 

■ 5r*; 

»> Money 



1 ® Adversary 

[ • Wants to take away your existence > 




Techniques Used 

. ® Social Engineering 
|^® Trade Shows; vyJt;* 

® Joint Ventures 




® Unsolicited requests for information 
® Acquisitions 

® Unsolicited requests for research assistance 
if--® International Conventions, Symposiums U • 
® Trash * : 

® Hacking 
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Take Responsibility 


Cost of Doing Business 


© Many companies view Eonnamin 
fEspranaae as “the coei oj.fiolnij business’ 


© Know what is most fimportanlto your 

nrganl-atlnn 

* The rm'« irnponsm iniomtalts?' it, the fewer the 
nwmtw-r at people that should fee access to it. 1 


:JhVwatcofitfnHS*.[o irlaS^ajuu tfstirriiJu win 
eafillEiU.S companies -ss Titus; than $1 Trillion 
sar year 

Eventually, the cost will be too great to bear 
Then it will be too latet 


• VtfHt ai „ your company’s strengths? 
.. Tl in is what your competitors wilt be after. 


ji .Thiwwno U* u> teoii anm Mnoiy acuMotfi^J w /ki«ui k 


gSiion -SL'fatesJe&. for 
afltsaitLons 




Mitigating the Threat 


Mitigating the Threat 


© Education and training di workfarea 

v Computer hspners. ant) NohrfliscIflsUre 
4ftr*UTnpnt4 „ 

'V V< • tfiwM lUVA IriflMl I jltlLti which jt&n you JO 


© High risk business activities: 

* Foreign Operations 

» Jbinl Vjtfenm with Pamlpn 
*■ pc»wan Travel 

• Tr'sde&icv* 


-* 'Tjiiiho 1 , rely solely on these to protect you 
*■ 'km get what you inspect, not what you expect 
® System must utilize active alerts 


© Don’t take what you don’t want “them” to 


E 
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Mitigating the Threat Travel 

% Foreign travel ^athigh risk activity ' jfe 
Require employees to notify company ofjfev 
personal foreign travel • 

• Provide threat briefings 

• Ask tough questions: 

e Will you be meeting anyone related to your work? 

/ c Will you be conducting any speaking engagements— 

■ formal or informal? - ' , 

‘ K : » Will you be taking any ihformation/materialsfrom work? 

"‘Sr’" 



M itigating the Th reat: Travel " 

® Foreign travel - a high risk activity (cont’d) 

• "Smart phonej-fc.foreign travel^ dumtlfflea . 

* «>;> 

• Prevent remote logging Into computer network 

<1 Even a "secure* connection will be using foreign internet 
connection 

• Require any company laptops, phones, etc. to be 
turned in while on travel 

• Buy “stripped down” laptop/phones for employees to 

use when on, foreign business travel.,^/ 
o Destroy hard drive after trip ' VS? 

o Neverconnect to your network with these 'de 





Mitigating the Threat " 

® Identify “high risk” users: 

• Significant foreign influence 

« Financial hardship 

• Underperforming (and advised as such) 

• Facing administrative/disciplinary action 

• Facing potential layoff or job termi natio 





b7E 
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^Section 81.1 

tlpli Intelligence Authorization 
;’ Vl Act of 1995 : f0 [ 

’e Head of each agency in 
" * the Executive Branch 
", ' shall ensure the FBI is 
advised immediately of 
^M|any informatioS^-is - 
' ’ f indicating classified 
information has/is being 
i disclosed to a foreign 
'i government without 
“ authorization 



Section 811 

Responsibilities of other agencies 
® Ensure FBI is consulted 'j . 
regarding all subsequent actions^Vfl| 
to determine the source of the 
loss • 

® Given complete and timely I aSSfll 

access' to'agency employees ffgjLtS' 

and records % 

® Avoid alerting subjects to the 
FBI investigation 



Hill 


Section 811 


Responsibilities of the FBI : 

j • FBI will ensure that information developed as a result 
' of the investigation relating to: S' ;j _ ' -Sfei 

I"? -;;- - Espionagelinformation relating to their personnel*' 

' - Information on operations and risks • : 

FBI will consult with the referring agency regarding the > 
espionage investigation 


Section 811 1 

® Waiver % 

® In extraordinary circumstances affecting vital 
national security interests/the President may 
waive the preceding requirements as they apply 
to the head of a particular department of agency 


b7E 
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Section 811 


- ® 811 does not : . 
v ' apply to: ' 

• Media Leaks 


• Security 
Violations' 


m i 


i : i 

l" - 


Wlx 




'Why is OOMSEC important? 


A historical example of exploiting an enemy’s 
communications 

Thesetting: ■' V-s,'?-', 

• May, 1942 in the Pacific ' 

• Japanese advance'since Pearl Harbor: «v 

o Philippines 1 

«> Malaya 
w Singapore 

e Dutch East Indies (Indonesia) 
o Thailand 
o Hong Kong 
o Guam 

rfco Wake Island 



OOMINT m Action 

® The U.S. broke Japan’s JN25 code and were 
able to prevent Japan’s capture of Port 
Moresby, New Guinea (Battle of Coral.Sea) in 
early May‘‘$i?42. . 

® U.S. discovered Japanese were planning 
another attack on the U.S. at “AF” at the 
beginning of June, 1942. 

• Japan’s plan was to set a trap for the U.S. to lure the 
aircraft carriers into reach 

• if successful, (Japan would have total dominatja 
the Pacificiu.,:- 



The Plan /Y 

, ® To determine where “AF’’ was, the U.S. 

/ sent innocuous messages from various 
locations to determine “AF” in the clear 

ife . 'rfWS* ; 

i®, Each possible location would send a . 

T message with a unique problem at the 

/ location. If the Japanese referred to any of 
the problems as being at “AF”, it identify 
their target 



Where is AF”? Midway 


® Midway Island sent fake 
message that it had a 
broken water distillation 
plant, and toe island 
needed fresh water 



® Japanese sent coded 
messages that “AF” 
needs fresh water 
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Communications Spies (cont’d) 


Michael Allen -Navy » 

' ChariesAnzalone- USMC' 'MM 
Stephen Baba - Navy 1 1 

Jeffrey Carney - Air Force/NSA h 
James Hall III -Army 
Joseph Helmich -Army 
Eric Jenott-Army 
Bruce Kearni- Navy 
Francisco Mira - Air Force H 
Frank Nesbitt - USMC/Air Forcef 
Charles Slatten -Army 
Henry Spade -Navy 
Michael Tobias and Francis Pizzo 



Worked at NS A 

® David Boone -Army/NSA 

' 

® Jeffrey Carney -Air Force/NSA 
® Robert Lipka - NSA 
® Ronald Pelton - NSA 


■ 




* Rad Acc^efs to a Cbae-Room 


Michael Allen - Navy 
Stephen Baba - Navy 
Christopher Boyce - Contractor 
Joseph Helmich -Army 
Eric Jenott ,- Army *>: 

Steven Lalas- Dept, of State ■ ■ 

Robert Lipka - NSA 
Frank Nesbitt - USMC/Air Force 
Charles Slatten - Army 
Henry Spade - Navy 
Michael Tobias - Navy 
John Walker- Navy 
Jerry Whitworth - Navy 


■mve .Communication^ ■ 
Plans/Techniques ^ 

® ChariesAnzalone -USMC 
® Christopher Boyce - Contractor 
® Jeffrey Carney -Air Force/NSA 
® James Hall III -Army 
® Andrevy Lee - Civilian . 

® Robert Lipka -NSA -'vi- 

® Francisco Mira -Air Force 
© Frank Nesbitt - USMC/Air Force 
® Ronald Pelton - NSA 
® Roderick Ramsay -Army 
® John Walker- Navy 
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Need to Know • . 3 

:#p 

® Each of us practice “need to know" 
everyday in our private lives 

• Bank account numbers 

• Social security numbers 

■ ft -■ ' :'?*a 

® Make sure someone has a need to know 
before you share any information with them 

• Don't just take their word for it 


mi 
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United States Senate 

( UMMITTtt ON I HR .11,/DICiAIO 
WASHINGTON IK yOhh) «v/t> 


December 17, 2013 

VIA ELECTRONIC TRANSMISSION 


The Honorable James B. Comey, Jr. 

Director 

Federal Bureau of Investigation 
935 Pennsylvania Avenue, N.W. 

Washington, DC 20535 

Dear Director Comey: 

On October 28, 2013 , 1 received a letter from the Federal Bureau of Investigation 
(FBI) in which it indicated that it had collaborated with the Office of the Director of 
National Intelligence (ODNI) on two training videos about the FBI’s National Insider 
Threat Program. The videos, titled Betrayed and Game of Pawns, were developed 
jointly by the FBI’s Counterintelligence Division and ODNI’s Office of the National 
Counterintelligence Executive (ONCIX). The FBI has also produced other insider throat 
materials, such as the brochure, The Insider Threat: An Introduction to Detecting and 
Deterring an Insider Spy . 1 

As I understand it, the National Insider Threat Program is the result of Executive 
Order 13587, issued by President Obama in October 2011, which established an 
interagency Insider Threat Task Force, to be staffed by the FBI and the ONCIX. 2 3 It also 
directed Executive Branch departments and agencies to develop their own insider threat 
programs. The President subsequently issued a Presidential Memorandum in 
November 2012 transmitting the National Insider Threat Policy and setting forth 
minimum standards for departmental and agency programs . 3 

These efforts have subsequently received press attention, some of which has 
focused on concerns about whether the program adequately protects whistleblowers.* 


1 Federal Bureau of Investigation, The Insider Threat: An Introduction to Detecting and Deterring an 
Insider Spy, http://www.fbi.gov/about-us/investigate/counterintelligence/insider_threat_brochure. 

2 Executive Order 13587 - Structural Reforms to Improve the Security of Classified Networks and the 
Responsible Sharing and Safeguarding of Classified Information, October 7, 2011. Available at 
http://www.whitehouse.gov/hie-press-office/2011/10/07/executive-order-structural-reforms-improve- 

security-classified-networks-. 

3 Presidential Memorandum - National Insider Threat Policy and Minimum Standards for Executive 
Branch Insider Threat Programs, Nov. 21, 2012. Available at http://www.whitehouse.gov/the-press- 
office/2012/11/21/presidential-memorandum-national-insider-threat-policy-and-minimum-stand. 

* For example, Marisa Taylor and Jonathan S. Landay, “Obama’s crackdown views leaks as aiding enemies 
of U.S.,” McClatchy (Jun. 20, 2013), available at 


The Honorable James B. Comey, Jr. 

December 17, 2013 
Page 2 of 2 

As you know, I strongly believe that whistleblowers play an important role in 
safeguarding the federal government against waste, fraud, and abuse. You too stated in 
your confirmation hearing that you believe whistleblowers are a critical element of a 
functioning democracy. Their willingness to come forward contributes to improving 
government operations. They often put themselves at risk of reprisal from their 
employers, sometimes being demoted, reassigned, or fired as a result of their actions. 
Under the Whistleblower Protection Act and Presidential Policy Directive 19, federal 
employees may not be retaliated against for reporting waste, fraud, and abuse.s 

Accordingly, some agencies have taken steps to prevent the insider threat 
program from chilling whistleblower communications. For example, the Office of the 
Inspector General for the Intelligence Community is developing training that integrates 
whistleblowing into the agency processes, making the Intelligence Community 
whistleblowing and insider threat programs mutually reinforcing. 

In order to assess whether training materials on the National Insider Threat 
Program provide adequate guidance on protecting whistleblowers, I respectfully request 
that you provide me with copies of Betrayed and Game of Pawns, as well as copies of 
any other training materials regarding the National Insider Threat Program or any FBI- 
specific' insider threat program. I would appreciate receiving these materials by January 
14, 2014. I know that you consider transparency to be an important value, and I trust 
that transparency on this issue will benefit both whistleblowers and our national 
security. 

Should you have any questions regarding this letter, please contac j 

I b f my staff a| I 


Sincerely, 





Charles E. Grassley 
Ranking Member 


cc: The Honorable James R. Clapper 

Director of National Intelligence 


http://www.mcclatchydc.com/20i3/o6/20/i945i3/obamas-crackdown-views-leaks-as.html#.Uccy- 

vmVHl. 

s Presidential Policy Directive 19, The White House, October 10, 2012. 
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U.S. Department of Justice 



Federal Bureau of Investigation 


Washington, D.C. 20535-0001 


December 31, 2013 


Honorable Charles E. Grassley 
Ranking Member 
Committee on the Judiciary 
United States Senate 
Washington, DC 205 1 0 

Dear Senator Grassley: 

This responds to your letter to Director Comey dated December 17, 2013, in which you 
requested copies of two training videos about the FBI's Insider Threat Program. The videos, 
titled Betrayed and Game of Pawns, were developed jointly by the FBI's Counterintelligence 
Division and the Office of the National Counterintelligence Executive (ONCIX). The videos are 
enclosed and are considered law enforcement sensitive for official use only, so we would request 
that you not disclose the videos further without contacting us. 

If I can be of add itional assistance in this or any other matter, please feel free to contact 
me at | | 


Sincerely, 


b6 

hlC 



Stephen D. Kelly 
Assistant Director 
Office of Congressional Affairs 


Enclosures 

1 - Honorable Patrick J. Leahy 
Chairman 

Committee on the Judiciary 
United States Senate 
Washington, DC 205 1 0 

1 - Honorable James R. Clapper 
Director of National Intelligence 



December 31, 2013 


Honorable Charles E. Grassley 
Ranking Member 
Committee on the Judiciary 
United States Senate 
Washington, DC 20510 

Dear Senator Grassley: 

This responds to your letter to Director Comey dated December 17, 2013. in which you 
requested copies of two training videos about the FBI's Insider Threat Program. The videos, 
titled Betrayed and Game of Pawns, were developed jointly by the 'FBI's Counterintelligence 
Division and the Office of the National Counterintelligence Executive (ONCIX). The videos are 
enclosed and are considered law enforcement sensitive for official use only, so we would request 
that you not disclose the videos further without contacting us. 

If I can be of additio nal assistance in this or any other matter, please feel free to contact 
me d ' ' ~1 


Sincerely, 
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U.S. Department of Justice 



Federal Bureau of Investigation 


Washington, D.C. 20535-0001 


December 31, 2013 


Honorable Charles E. Grassley 
Ranking Member 
Committee on the Judiciary 
United States Senate 
Washington, DC 20510 

Dear Senator Grassley: 

This responds to your letter to Director Comey dated December 17, 2013, in which you 
requested copies of two training videos about the FBI's Insider Threat Program. The videos, 
titled Betrayed and Game of Pawns, were developed jointly by the FBI's Counterintelligence 
Division and the Office of the National Counterintelligence Executive (ONCIX). The videos are 
enclosed and are considered law enforcement sensitive for official use only, so we would request 
that you not disclose the videos further without contacting us. 

If I can be of additional assistance in this or any other matter, please feel free to contact 
me at) | 

b6 

Sincerely, b7 ' 



Stephen D. Kelly 
Assistant Director 
Office of Congressional Affairs 


Enclosures 

1 - Honorable Patrick J. Leahy 
Chairman 

Committee on the Judiciary 
United States Senate 
Washington, DC 20510 

1 - Honorable James R. Clapper 
Director of National Intelligence 
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December 31, 2013 


Honorable Charles E. Grassley 
Ranking Member 
Committee on the Judiciary 
United States Senate 
Washington, DC 20510 

Dear Senator Grassley: 

This responds to your letter to Director Comey dated December 17, 2013, in which you 
requested copies of two training videos about the FBI's Insider Threat Program. The videos, 
titled Betrayed and Game of Pawns, were developed jointly by the FBI's Counterintelligence 
Division and the Office of the National Counterintelligence Executive (ONCIX). The videos are 
enclosed and are considered law enforcement sensitive for official use only, so we would request 
that you not disclose the videos further without contacting us. 

If I can be of add itional assistance in this or any other matter, please feel free to contact 
me ad j 


Sincerely, 
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Stephen D. Kelly 

Assistant Director 

Office of Congressional Affairs 
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12:30 PM 
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FBI 
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Date: 16/6/2013 Attended: f 


uci r 

DAU VirtCSrtt LiSi 
SC Mark Bartek 


Other Participants: 


none 


Committees 

/Subcommittees 


House Appropriations Subcommittee on Commerce Justice Science and Related 
Agencies(HAC CJS) 
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b7C 


Members/Staff: Rep. Frank Wolf, staffe 

Executive Summary: 

Insider Threat / | | 

Details of Event: 

On 06/06/2013 the FBI provided a classified briefing to Rep. Frank Wolf and staff: 11 Insider Threat program to 


Follow Up Action: 
none 

Attachment: 


b6 

b7C 


b6 

b7C 

b7E 


0 




Congressional Affairs Office 

Congressional Contacts 


Event Date: j 3/12/2014 classification Level: 

p ate j 03/42/2014 1 2014-600 j 

Entered: * * 

Q Briefing O Hearing ( } SAC C V Q HQ C V O FOC 

BriefType: 


Unclassified 


O Proactive O Reactive ; 

® Other 


i K of SAC cv 
1 Visits: 


Entered By: | 


Event Date: j 3/12/201 4 Event Time: 

Unit: jcLU II 


' 1 I ' 

Topic: Acknowledgement from Grasslev slaffe l I that he did Division: |~ 

not respond to FBI’s offer more than a month ago for a briefing on I 

■the matter of Insider Threat program, and request for a briefing. 
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Person: 
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DOJ Contact: 
FBI 

Participants: 


Other Participants: 

Committees 

/Subcommittees 


Date: 


Attended: J" 
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Members/Staff: [] 


^Grassley staffer 


Executive Summary: 

I r e InsiderThreat program brieing 

Details of Event: 


Acknowledgement from Grassley staffel 
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for a briefing on the matter of Insider Threat program. Agent 
agreed. Will follow up with prospective date/time. 

Follow Up Action: 


hat he did not res pond to FBI’s offer more than a month ago 


renewed the offer of a briefing.^ 
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House Permanent Select Committee on Intelligence(HPSCI) 
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Members/Staff: Miller, King, Schiff, Rooney, Pompeo, Conaway, Nunes, Heck, Himes, Sewell, Bachman 
Executive Summary: 

Fiscal Year 201 5 HPSCI Member brief on FBI budget. 

Details of Event: 

The brief was held at a classification level that precludes most information discussed from being entered into this 
log. Mr. Miller acted as Chair and opened the brief with positive remarks and praise for the FBI and a negative 
opening statement regarding DHS-INA past performance. He primarily wanted to hear from FBI about the state of 
■the Insider Threat Program and current levels of resources dedicated to Cyber matters. Mr. King left the Hearing 
immediately following roll call and did not participate. Mr. Shiff mainly asked about FBI plans moving forward for 
Insider Threat, cyber and surveillance matters, Mr. Conaway aske d about NSRP, surveillance capabilities, the FBI 

1 I AII of his questions were answered with no get- 
backs. 5r. Heck was curious about which areas the Bureau is wilting to accept risk, in light of decreasing budget. 
No get-backs for Heck. Ms. Bachman's only questions were about FBI linguists and were answered to her apparent 
satisfaction. No get-backs for Bachman. More details are included in the TS/SCI level IMS. 

Follow Up Action: 

For Mr. Miller- Are all FBI computers, both NIP and non-NIP, auditable? ! f idvised he would p rovide answ er 

after confirming. For Mr. Schiff-Wants specific percentage of FBI CT work both before and after 9/1 1 .| 1 

advised he would get actual numbers, ~ 
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Topic: Briefing for Grassiey staffers regarding FBI Insider Threat Program Division: 
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Person: 


DOJ Contact: 

FBI 

Participants: 


Date 




Attended: 


ud 


Other Participants: 

Committees 

/Subcommittees 


b6 
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Members/Staff: 
Executive Summary: 


Briefing for Grassley staffers regarding FBI Insider Threat Program 
Details of Event: 


Briefi ng for Grassley s taffers regarding FBI Insider Threat Program. This briefing was coordinated in advance with 
staffe j [ wh o request ed a briefing specifical ly on t he FBI Insider Threat program - no other topic v/as 

proposed or request ed b l fr o be briefed. After UC ) I intro duced himself and noted his role among other 

things as a l l of the Insider Threat task Force, staffer] [ _ opened with a remark that FBI videos did not 

distinguish Insider Threat from whistleblowers. Agenf 1 Reminded staffers that FBI was there, per 
I I reauest. to brief on Ihe topic of Insider Thre at Prog ram, and invited staffers lo ask questions regarding the 

Insider Threat program, and noted to staffers that UC I I was not there to brief on matters regarding 
whistlehlnwing Reference was made to a website that may provide guidance for propspective whistleblowers. UC 
I h oled that, as far as he knew, if someone is a whistleblower then any investigation under Insider Threat is 
suspended; he further noted that he v/as not asked or prepared to brief on whistleblowin g, and was ready, wil ling, 
and able to to proceed with briefing on the matter of the Insider Threat program. Staffers ! l efused 


to keep to the subjec t of Insider Tty i 
whislleblowing, Agenj | again reminded staffersT 

briefing on the Insider Threat program, and Age 1 4 | t real 


eat program, and instead badgered exclusively for statements regarding 


? ml “ ! that they had requesled-oahtioLaa 

to the stall 


- s the content I 

email that requested a briefing only on the topic of Insider threat program. Agent I I 

. that if th ey want a briefing in tile future on whistleblowing, then they should make that request. Staffers 1 

I refused and continued their badgering wilh questions unrelated to the insider Threat program. Grassley 
staffer! 


,of staffeL 
further told staffers 
nd 


Continued bad faith rendered the purpose of the instant briefing null, and FBI departed. 


Follow Up Action: 
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Topic- Senate Appropriations/Commerce, Justice, Science subcommittee Division: Ffd 
staff briefing, re: FY 201 2 Budget Rollout (dandified)- 1 
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Person: 
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FBI I DAD Janic e Lambert (FD) 
Participants: ! lfFDi 

f„. ^ , x °i 

Other Participants: 


N/A 


Committees 

/Subcommittees 


Senate Appropriations Subcommittee on Commerce Justice Science and Related 
Agencies(SAC CJS) 
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Members/Staff: Siaf fl 1 (majority staff cierk-Sen. Mikulski) 

I ^majority staff- Sen, Mikulski) 


Executive Summary: 
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Details of Event: 

s^e^i worewr- 

(U) SAC/Commerce, Justice and Science (CJS) subcommittee majority staffer ~l 

were briefed on Ihe FBI's FY 2012 Budget request by FD's DAD and three FD/Budget staff. 

(i^f^tThe briefing was very well received by the SAC/CJS staffers, The “get backs" from F D to (he staffers in clude 
Ihe following: justification information on theconstruction base figures, including the shortfall | 
construction cuts; a "cheat sheet" version of budget figures for Sen, Mikulski’s use; information on the "Insider 
Threat" portion of the Foreign Intellige nce budget, i.e., is it a new initiative or included in the base funding figures; a 
request for a demonstration of Ihe nev j t n unclassified version of 

the PPT presentation used for the briefing; and, a request for a briefing on the proposed closure of several Resident 
Agencies (RA's), as well as a map of the FBI's Field 0ffices.36gg6T/ M0r0RHr- 

Follow Up Action: 

1- Justification information on the construction base figures, including the shortfalls [ C onstruction cuts; 

2- a "cheat sheet" version of budget figures for Sen. Mikulski’s use; information on the "Insider Threat" portion of the 

Foreign Intelligence budget, i.e., is it a new initiative or included in Ihe base funding figures; 3- a request for a 
demonstration of the ne| |4- an unclassified version of the PPT 

presentation used forth! 5/ifetirt/j) Shd.b- a request tor a Briefing on me proposed closure of several Residenl 
Agencies (FtA's), as well as a map of the FBI’s Field Offices. 
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Person. 
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FBI 

Participants: 


N/A 


Boston SAC Richard DesLauriers 


Other Participants: 

Committees 

/Subcommittees 


Jhione 


Date: 


Attended: 


Members/Staff: 


Rep Michaud /D - 2nd MEjf" 
‘ ~ :nfei 


MA)( 

Langevi n (D - 2nd W. 

| t Rep Olver (6 - 1st MA)f 
* ]Sen J Reed (RIF 


Senatfl? AyotSS (NH)/['~ 


Sen Jolin Kerry (MA{ 


Executive Summary: 
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” ioihMAlF I 


I Rep Keating (D. 

3 Sen Scott Brown (MAI 
en Wh itehouse ( Rlli 
|(D - 3rd MA| 
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Details of Event: 

SAC DesLauriers conducted co urtesy visits with the following Re presentatives. Senators and their corresponding 
staff: Rep Michaud (D - 2nd ME 1 I Rep Keating <D - 10th MAVRarmti I 

Senator Avotte (NHVSamantha R oberts & John La wrence: Rao Lannevin /r> - ?hrl Rivnavis Hake & Christopher 
i Rep Keating (D - 10th M fl i Reo Olver (D - 1st Uif \ | Sen Scott Brown <MA)/ 

t en J, Reed fRli (San Whitehouse (Kl)/ 1 p en John 

Kerry (MA I h Rep McGovern (D - 3rd MAI [ Rep Michaud requested that the 

SAC consult with Maine’s US Attorney to review the State's report following an officer-involved shooting at a VA 
hospital which resulted in the death of one of Rep Michaud's constituents (constituent’s family, also constituents, are 
petitioning (or a federal review). It was fun to note that Rep Keating's office was once occupied by John F. 

’Kennedy. Senator Ayotte was extremely supportive of the FBI and very knowledgeable about FBt-relaled issues 
(such as the Patriot Act). She expressed strong support to help the FBI achieve its mission. She mentioned a visit 
she had earlier in the day with an executive with Microsoft who explained to her that Microsoft has developed a new 
imaging technology that could be used to combat child pornography. Microsoft would like to offer this software to 
the federal government for free if th ey feel it could be h elpful. Sen Ayotle’s office provided th e following contac t 
information at f^ir.rnsnfi for follow-up) [Microsoft Federal Government Affairs | | 

fe microsoft.com. Ref) LaiKJUVI!! mentioned that his career aspiration as a young man before his 
accident was to become an FBI Agent. His staffers had follow-up issues regarding Cyber threats and Cyber 
security. Specifically mentioned was the recent Cyber IG report that was critical of the FBI, yet the staffers' 
interaction with the private sector implied great confidence in the FBI's abilities to investigate intrusions. The other 
staffe i I wanted to know what more the FBI is doing or could do to prevent future problems like 

"Wikileaks". They requested a "get back" regardin g the National Insider Threat Program and SAC DesLauriers 
mentioned tha t I miqht be good choices for that. Sen Whitehouse mentioned that 

he will be sponsoring legislation with Sen Kyi addressing "Cyber Security Public Awareness" and wanted to know 
more about what the FBI does in that arena. Sen Whitehouse’s biggest concern right now is that when someone 
becomes a victim online (e-mail, internet, etc.) they don’t know where to turn for help. Sen Whitehouse wants to 
make sure that the government has solutions to offer the public when they find themselves as online victims AND he 
wards the. public to know (public awareness campaign) immediately where they should turn to find that help. All 
visits were f riendly and 
(D - 2nd MA| 


pieasam. At/amnif rn 
<D - Sth MA) 


et up appointments 

p- 1st ME), 


t or saw uesLauriers wnn representatives Neat 
? - 1st NH) and Senators Snowe (ME) and 
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Congressional Affairs Office 

Congressional Contacts 


Shaheen (NH) were unsuccessful. Rep Frank (D - 4th MA) declined an invitation to meet with SAC DesLauriers in 
'D.C. because they have met each other on several occasions previously. 


Follow Up Action: 


None. 
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To pj c; Insider Threat Study 
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8/1/2011 Event Time: 
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Person;! 

DOJ Contact: 


Date: *7/27/2011 


Attended: 


FBI UC| 
Participants: I 


I SC Patrick Reidy 


Other Participants: - 


/Subcommittees Senafe Select Committee on Intelligence(SSCI) 


Members/Staff: 


Executive Summary: 


Details of Event: 

(U) The brief was requested by staffej 
Audit and Oversights Staff of the SSCT7 


ps part of the Insider Threat Study being conducted by the 


{U) UC I ~b rovided a comprehensive overview of the Enterprise Security Operations Center's (ESOC)programs 

and capabilities of detecting and recording unauthorized access to the computer systems of the FBI. The programs 
used and future plans for the ESOC to address the insider threat were discussed. Cooperation and interaction 
within the FBI and the intelligence community were described. 

Follow Up Action: 

(U) Staff requested the Circular number for one OMB 
circular regarding encryption 
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Senate Select Committee on Intelligence(SSCI) 
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Mornbers/Staff: [ 
Executive Summary: 
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Details of Event: 

Threat Study being conducted by the b 6 

b7C 

combating the insider threat problem, 
both within the FBI and the intelligence community (IC)as a whole. He discussed the outreach and education 
program including the use of the movie ’ Betrayed" and training programs. The cooperation between agencies in 
prevention, deterrence and investigation was described. Coleman also detailed the CD’s role in carrying out 
investigations of unauthorized disclosure and espionage throughout the 1C. The staff asked a variety of questions 
relating to the topic. 

Follow Up Action: 

(U) Staff requested the statutory language relating to a S500.000 reward for information leading to arrests in counter 
intelligence investigations. They also requested the working title to an Executive Order relating to Insider Threat. 
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DOJ Contact: 


Date: 


Attended: 


FBI 

Participants: 


SAC Nancy McNamera 


Other Participants: 


None 


Committees 

/Subcommittees 


Senate Appropriations Subcommittee on Commerce Justice Science and Related 
Agencies(SAC CJS) 


Members/Staff: [ 
Executive Summary: 
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Details of Event: 

Staffer requested support from Finance Division to stop by the MW FO during a scheduled visit to the state, 
f fctaffs Sen. Johnson (R-WI) who sits o n our appropri ations subcommittee. SAC McNamera met with the 

staner ana provided a backbrief to OCA. Overall ! t nessage was that the Senator is very supportive of 

the FBI's mission and wants to restore any funds lhal the FBI is staled to lose. However, the Senator is atso 
concerned about overlapping missions throughout the USG. in addition, he is interested in Cyber and whether is 
USG is efficiently meeting that mission requirement. SAC McNamara highlighted three issues that she briefed: 1) 
responding to Cyber concerns, SAC focused on the insider threat issue and everything that the FBI is doing to lock 
down our systems and address vulnerabilities. She is going to talk with CD DAD Anderson about providing the 
staffer with a copy of the movie "Betrayed" produced by CD. 2) SAC spoke specifically about cost savings 
measures in MW-i.e. they've parked cars. She also talked about the RA closings and how, more than just saving 
rent mo ney, it's abo ut gaining efficiencies via the consolidation. 3) Finally, they talked about HIDTA and the SAC 
advised l t hat based on her experience in MW, it is an area where there may be some mission overlap. 

She was clear to say lhal she didn't speak for the HIDTA program, but only about her experience in MW. 

Follow Up Action: 


•None. 
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Members/Staff: Staff for; 

Sen. Chris Coons 
Sen. Frank Lautenberg 
Rep. Frank LoBiando 

Executive Summary: 

FBI Phila participated in a DSS presentation on insider threats and defensive briefing for govt contractors and 
Congressional staffers. 

Details of Event: 

S/ I l and S/| (introduced FBI video "Betrayed", followed by slides about most significant threats to b6 

information and sedulity lacerfby government contractors and personnel. 

Follow Up Action: 

None 
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Congressional Hearings 
Feb. 10, 2011 - Final 

House Select Intelligence Committee Holds Hearing on 

Worldwide Threats 


ROGERS: 

- We'll call the committee and we'll come to order. 

I want to welcome Director Clapper and our other witnesses this morning. They are very busy 
people. 

And I appreciate you all taking the time today away from that important work from your 
agencies to participate in today's hearing. 

Please pass along our thanks and appreciation to the men and women in your agency for their 
commitment and dedication in the defense of the United States. We are eternally grateful for 
their sacrifices. 

I also want to welcome Dutch Ruppersberger as the committee's new ranking member. He is a 
solid leader. His dedication and talent will serve the committee and country well. 

Dutch is also a friend, and I look forward to working with him to foster the strong bipartisan 
energy that we're going to need to lead this committee to our oversight responsibilities and to 
keep America safe. And of course it never hurts to have a former prosecutor on your side. 

I'm looking forward to the discussion of threats in the witnesses' statements this morning, and the 
questions and answers that follow. 

Before we get to that, I want to talk a moment about where I would like the committee to go in 
the new Congress. And we've had the opportunity to talk with each of you about that direction, 
from reasserting oversight to taking a strong evaluation of the 1 0 years where the budget has 
grown exponentially and changed significantly; the budget, cyber issues, leaks and many others. 

On reasserting oversight, it's a profound honor and a tremendous responsibility to assume the 
role of the HPSCI chairman in such an important juncture in our nation's history. 

The U.S. intelligence community is vital to defending our nation from many threats that we face. 
I have no doubt that the hard work of our intelligence professional is one of the primary reasons 
there has not been a successful major attack in the homeland since 9/1 1, despite numerous failed 
and disrupted plots and A1 Qaida's unrelenting efforts to attack the United States. 





I don't believe it's been deployed on every node., but I will get back to you on that for the record, 
sir, 

LANGEVIN: 

Director Mueller? 

MUELLER: 

I would say that what has been in place for a couple of years it called the National Cyber 
Investigative Joint Task Force, is a hub of identifying an early — attributing attacks, big, larger or 
small. You have all of the relevant agencies there and the expertise and the tie-in into the 
relevant agencies. 

If it — if it turns out to be an attack by your -- your high school student down the street, then we 
obviously would take it'd be a crime. More particularly that, it goes to the question of stopping 
an attack, depending on the — from whence the attack originates, you would have people at the 
table there who have the capability of doing it. If it originates overseas, certainly NSA, CIA, and 
others. If it originates in the United States, we would have jurisdiction. If it comes to the — in 
putting a wall on between the attackers and particular entities within the United States, DHS 
would have a role. 

But we have a focal point that identifies immediately the attack and then immediately tries to 
deterring the focus of that — that attack and utilize all of the capabilities we have to address it, 
regardless of whether it's in the intelligence side or the — or the law enforcement side. 

LANGEVIN; 

Let me turn quickly to some of the things we're talking about, especially with respect to 
protecting dot-mil and — and — and dot-gov, our perimeter defenses. What is our level of 
progress in being able to protect against — and dealing with the insider threat, as it relates to 
cyber? 

f 

CLAPPER: 

Well, that's -- that is — that issue has — has come to the fore and been reaffirmed by the 
WikiLeaks disclosures. And certainly within the intelligence community, at least, we — we have, 
I think, a strategy and embarked on an improvement program to attend to the insider threat, 
whether it's WikiLeaks or any — any sort of insider threat through better identification of people 
who are on networks, controlling movable media, and most importantly — and this applies for — 
to several purposes -- auditing and monitoring. 

And we're -- our progress is uneven to this point. And we've embarked on a campaign to — to 
police that up, particularly within the intelligence enterprise. 
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lilnitcd States Senate 

t < iM.ViTTffc ON i HI-. JUfJICiAIO 
WASHIMlHON iX VOhli) ti'.Ol. 


December 17, 2013 

VIA ELECTRONIC TRANSMISSION 


The Honorable James B. Comey, Jr. 

Director 

Federal Bureau of Investigation 
935 Pennsylvania Avenue, N.W. 

Washington, DC 20535 

Dear Director Comey: 

On October 28, 2013 , 1 received a letter from the Federal Bureau of Investigation 
(FBI) in which it indicated that it had collaborated with the Office of the Director of 
National Intelligence (ODNI) on two training videos about the FBI’s National Insider 
Threat Program. The videos, titled Betrayed and Game of Pawns, were developed 
jointly by the FBI’s Counterintelligence Division and ODNI’s Office of the National 
Counterintelligence Executive (ONCIX). The FBI has also produced other insider threat 
materials, such as the brochure, The Insider Threat: An Introduction to Detecting and 
Deterring an Insider Spy. 1 

As I understand it, the National Insider Threat Program is the result of Executive 
Order 13587, issued by President Obama in October 2011, which established an 
interagency Insider Threat Task Force, to be staffed by the FBI and the ONCIX. 2 3 It also 
directed Executive Branch departments and agencies to develop their own insider threat 
programs. The President subsequently issued a Presidential Memorandum in 
November 2012 transmitting the National Insider Threat Policy and setting forth 
minimum standards for departmental and agency programs .3 

These efforts have subsequently received press attention, some of which has 
focused on concerns about whether the program adequately protects whistleblowers.^ 


1 Federal Bureau of Investigation, The Insider Threat: An Introduction to Detecting and Deterring an 
Insider Spy, http://wwv.fbi.gov/ about-us/investigate/countermtelligence/insider_threat_brochure. 

2 Executive Order 13587 - Structural' Reforms to Improve the Security of Classified Networks and the 
Responsible Sharing and Safeguarding of Classified Information, October 7, 2011. Available at 
http://www.whitehouse.gov/the-press-office/20il/io/07/executive-order-structural-reforms-improve- 
security-classified-networks-. 

3 Presidential Memorandum - National Insider Threat Policy and Minimum Standards for Executive 
Branch Insider Threat Programs, Nov. 21, 2012. Available at http://www.whitehouse.gov/the-press- 
office/2012/11/21/presidential-memorandum-national-insider-threat-policy-and-minimum-stand. 

-« For example, Marisa Taylor and Jonathan S. Landay, “Obama’s crackdown views leaks as aiding enemies 
of U.S.,” McClatchy (Jun. 20, 2013), available at 


The Honorable James B, Comey, Jr. 

December 17, 2013 
Page 2 of 2 


As you know, I strongly believe that whistleblowers play an important role in 
safeguarding the federal government against waste, fraud, and abuse. You too stated in 
your confirmation hearing that you believe whistleblowers are a critical element of a 
functioning democracy. Their willingness to come forward contributes to improving 
government operations. They often put themselves at risk of reprisal from their 
employers, sometimes being demoted, reassigned, or fired as a result of their actions. 
Under the Whistleblower Protection Act and Presidential Policy Directive 19, federal 
employees may not be retaliated against for reporting waste, fraud, and abuse. s 

Accordingly, some agencies have taken steps to prevent the insider threat 
program from chilling whistleblower communications. For example, the Office of the 
Inspector General for the Intelligence Community is developing training that integrates 
whistleblowing into the agency processes, making the Intelligence Community" 
whistleblowing and insider threat programs mutually reinforcing. 

In order to assess whether training materials on the National Insider Threat 
Program provide adequate guidance on protecting whistleblowers, I respectfully request 
that you provide me with copies of Betrayed and Game of Pawns, as well as copies of ■ 
any other training materials regarding the National Insider Threat Program or any FBI- 
specific insider threat program. I would appreciate receiving these materials by Januaiy 
14, 2014. I know that you consider transparency to be an important value, and I trust 
that transparency on this issue will benefit both whistleblowers and our national 
security. 


Should you h ave any questions r egarding this letter, please contact] 
[of my staff at| | 


b6 

b 7 C 


Sincerely, 



S' 


Charles E. Grassley 
Ranking Member 


cc: The Honorable James R, Clapper 

Director of National Intelligence 


http://www.mcdatchydc,<x>m/2oi3/o6/2o/i945i3/obamas-crackdown-views-leaks-as.htm]#.Uccy~ 

vmVHl. 

5 Presidential Policy Directive 19, The White House, October 10, 2012. 
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Responses of the Federal Bureau of Investigation 
to Questions for the Record 
Arising from the April 14, 2011, Hearing Before the 
House Permanent Select Committee on Intelligence 
Regarding the FBI’s Fiscal Year 2012 National Intelligence Program Budget 


Questions Posed by Chairman Rogers 

1. How much does a surveillance team cost? Please provide the costs of various sized 
teams and armed vs. unarmed teams? 


Response : 




In Fiscal Year 201 1 it costs appro ximate! 


armed surveillance team and approximately 
unarmed surveillance team. 




to establish a new 


27 During the hearing 


to establish a new 


J — I 


jstated that the FBI can currently surveij [targets on a 


b7E 


bl 

b3 


24x7 basis. What is the FBI’s goal for the number of targets it is able to cover on a 24x7 bg 
basis? How many additional positions and how much additional funding would be b7c 
required to meet this goal? 


Response : 

m — - 


present, the FBI is capable of covering targets on a 24/7 basis. Our 

goal is to build a national surveillance capacity to provide for additional coverage. 


bl 

b3 


3. The FBI requested no enhancements in FY 2012 for linguists. How does FBI plan to 
handle the increasing volume of documents that requires translation? 

Response : 

(U) The demands on the FBI’s Foreign Language Program (FLP) fluctuate and 
priorities are adjusted frequently to meet the greatest need at any given time. The 
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b. Is the FBI giving sufficient attention to other counterintelligence threats? 

How so? 

Response: 


i^TNjp^Because the FBI’s National Cl Strategy prioritizeC 


]The FBI’s 


with appropriate attention afforded to 


bl 
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J Tn additions 


lall of which are addressed in the FBI’s 


5. Last year, the FBI created | [ Regional Intelligence Groups (RIGs) to facilitate 

cooperation among field offices in the same region. 


b7E 


a. What specific value-added have the RIGs provided? 

Response : 
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The FBI continually recruits for all necessary languages, and attempts to address all 
work possible. The chart provided as Enclosure A reflects the hiring in recent 
years up to 12/3 1/06 in the critical counterterrorism languages. When the FBI 
does not have the language resources for a particularly rare language, we work with 
contractors and with the National Virtual Translation Center (NVTC) to address 
those needs. In one situation, the FBI used Department of Defense (DoD) 
contracts to provide cross-training for FBI Arabic linguists on an unusual dialect of 
Arabic that was needed. These resources provide a surge capacity in the FBI=s 
most critically needed languages as well as a pool of linguists in less commonly 
needed languages that are important to the FBI=s mission. Contract linguists must 
pass the same language test batteries and security vetting as full-time employees. 
Their Top Secret clearances, native-level proficiency in the foreign language, 
high-level of skill in English, and knowledge of the target culture make FBI 
contract linguists a highly desirable commodity in the IC. Many of the FBI=s 
contract linguists provide support in languages that the full-time linguist staff does 
not cover. The FBI depends on the contract linguists and NVTC for a substantial 
amount of the needed support in many languages critical to the FBI=s mission. 

While the FBI continues to hire new contract linguists, it is currently converting 
many of the talented contract linguists hired since 9/1 1/01 to full-time language 
analysts, with the goal of maintaining a language workforce composed of one-third 
contract linguists and two-thirds FBI language analysts. This ratio will enable the 
FBI to maintain a stable workforce and will provide greater job security and 
benefits for the linguists proficient in the languages most needed to meet ongoing 
national security requirements. 

Since May 2006, the FBI has made a special effort to focus on the backlog and has 
decreased the unaddressed counterterrorism work in the most critical languages to 
less than 1,000 hours. While the figures referenced in the May 2006 hearing 
pertain to counterterrorism cases only, audio backlog continues to be a concern for 
the FBI. In general, audio collection in the difficult and unusual languages 
represents only about 1% of the FBI=s total audio collection in the past four years. 

WHISTLEBLOWERS 

17. Whistleblower Mike German has alleged that the FBI failed to investigate a potential 

terrorist link between white supremacist and Islamic extremists. During our investigation 

of this case, our staff received two different versions of a crucial transcript. Neither version 

of this transcript was complete. 


These responses are cutrent as of 2/8/07 
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a. Can you explain the apparent discrepancies in the two versions of the 

transcript? 

Response : 


In connection with its investigation of this matter, by letter dated 2/3/06 the 
Committee requested from the DOJ OIG copies of documents the OIG relied upon 
in preparing its reports. The document request included the transcript of the 
1/23/02 tape-recorded meeting between members of the foreign and domestic 
terrorist groups, which German had provided to the OIG in February 2003, and any 
other transcripts made of that meeting. By letter dated 7/27/06, the FBI provided 
the Committee with copies of the FBI documents responsive to this request, 
including copies of two transcripts of the 1/23/02 meeting. 

One version of the transcript, identified with the text marking A037eb01 .t3 @ at the 
top left of each page, was obtained from German on 2/12/03 during his interview by 
investigators from DOJ=s OIG and FBI. German produced and referenced 
portions of this transcript in support of information he provided in his signed, 
sworn statement, and this version was attached to and made a permanent part of 
German=s sworn statement. This version of the transcript is a rough draft of the 
transcription of a consensually monitored conversation that occurred on 1/23/02; it 
contains several instances of AunintelligibleO conversations on the recording and 
abruptly ends on page 126. On page 49, the construction of this document changes 
from a rough draft format to FBI FD-302a format, and continues sequentially but 
displays the page number starting at 46. This AcombinationO document submitted 
by German contains duplicative pages of the rough transcription and the FD-302a, 
so that pages 46, 47, 48, and 49 are misnumbered yet sequential. It is unknown 
why German provided to OIG and FBI interviewers only 126 pages of a total 167 
pages or why this document has a combination of transcript formats. 

The second version of the transcript, identified with the marking AFD-302a@ at the 
top left of each page, represents the draft of the entire transcription in the official 
FD-302a format. Because the header and footer on each page of an FD-302a 
reduce the remaining printing surface, the pages of this FD-302a draft do not line 
up exactly with the pages of the rough draft portion of the version obtained from 
German. In the FD-302a draft, many, though not all, of the Aunintelligible@ 
portions that appear in the rough draft have been clarified. This FD-302a version 
is a complete transcription of the 1/23/02 conversation at 167 pages, or 31 pages 
more than the version provided by German. 


These responses are current as of 2/8/07 
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b. Which of the two transcripts do you consider most accurate? 


Response: 


For the reasons discussed above, the version identified with the FD-302a marking 
at the top left of each page is the most accurate. 

c. Will you provide the committee with the tape that this transcript is based 
on, in its complete form? If not, why not? 

Response : 


The Committee has not previously requested a copy of the tape in connection with 
its oversight investigation of this matter. Should we receive a Committee 
oversight request from the Chairman regarding this matter, we would be pleased to 
consult with DOJ as to the appropriate response. 


Questions Posed by Senator Grassley 
AMERITHRAX INVESTIGATION 

18. a. Why was Richard Lambert removed as the head of the Amerithrax 

investigation? 

Response : 

Richard Lambert served as the Inspector in Charge of the Amerithrax investigation 
from 9/20/02 to 9/1 6/06. On 5/22/06, he applied for promotion to the position of 
Special Agent in Charge (SAC) of the FBI's Knoxville Division. The Senior 
Executive Career Board reviewed the qualifications of the interested candidates 
and recommended Richard Lambert for selection. On 6/16/06, Director Mueller 
announced the selection of Mr. Lambert as the Knoxville SAC. 

b. Was it related in any way to disagreements between him and others 
working on the investigation about the proper scope and focus of the FBI=s inquiry? If so, 
please explain. 

Response : 

Mr. Lambert applied for and was selected as Knoxville SAC based on his 
qualifications for the position. 


These responses are current as of 2/8/07 . 
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and effectively collecting, sorting, and examining relevant data, the FBI will be 
able to rapidly identify indicators of misuse and other inappropriate activity. 
Along with these techno logy- driven innovations, the FBI will continue to use 
regular personnel reinvestigations, including reviews of employees= financial 
circumstances, to detect willful and/or potentially criminal misconduct. 

d. What guidelines and training govern how agents deal with potential 
informants who may be engaged in trading or short-selling securities or may be selling 
information to hedge funds? 

Response: 


The FBI has instituted a new comprehensive informant validation process for use 
by field offices and FBIHQ. The validation process includes quarterly SSA 
reports addressing the sources= motivation, access, timeliness, corroboration, and 
history. As discussed above, AG Guidelines address unauthorized criminal 
activity by confidential sources. These AG Guidelines are covered in the New 
Agent core-training received at the FBI Academy and reinforced through regular 
legal training provided in field offices during the remainder of an S A=s career. 

e. In October of this year, a former FBI agent Jeffrey A. Royer was 
sentenced to six years in prison for racketeering and securities fraud. According to 
witnesses at trial, the agent provided non-public FBI information to an outside party who 
used the information to spread negative publicity about companies and profit from 
short-selling their stock. What lessons can the FBI learn from this case? 

Response : 


In response to a recommendation in the March 2002 Webster Commission report, 
the FBI's Security Division (SecD) developed and implemented a comprehensive 
security awareness, education, and training program for all persons with access to 
FBI information. This comprehensive approach included the development of a 
professional cadre of highly trained Chief Security Officers, who now provide FBI 
personnel with the most up-to-date security policy, training, lessons learned, and 
best practices. 

SecD uses a variety of educational methods, to include formal classroom training, 
web-based training, written guidance, and mentoring, to enhance the security 
awareness and education of the entire FBI population. Formal classroom 
instruction has included: the authorized procedures for releasing information to 


These responses are current as of 2/8/07 
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the public; refresher courses on establishing an information recipient=s 
"need-to-know"; and the potential penalties for deviating from established 
procedures. Instruction is also provided in the form of ANon-disclosure and 
Releasability briefings, @ during which all personnel execute a "Classified 
Information Non-disclosure Agreement" and "FBI Rules of Behavior" form 
acknowledging their responsibility to protect and properly handle FBI information. 
SecD also provides a host of additional training opportunities and materials, each of 
which serves to reinforce security awareness throughout the FBI. 

While this approach will not stop a trusted insider intent on disclosing information 
for improper purposes, it ensures the employee is educated on proper ■information 
handling techniques and encourages each employee to report others who violate the 
rules. In other words, FBI employees now better understand their role in 
protecting and ensuring the security of FBI information, personnel, and facilities. 

f. What safeguards exist to prevent agents like Royer from similarly 
profiting on non-public information about ongoing investigations? 

Response : 

Please see our responses to subparts c and e, above. 

USE OF GOVERNMENT-OWNED OR LEASED AIRCRAFT 

36. I understand that the FBI operates a number of executive jets as part of its aviation 
program for both operational use and for official travel by senior FBI officials. 

a. Please identify the number, type, and cost of aircraft owned and/or leased 
by the FBI and used for both operational purposes and travel by senior FBI officials. 

Response : 


The FBI reads this question as distinguishing between aircraft used to meet 
Amission requirements @ of the FBI and those used for the Aofficial travel® of 
Asenior Federal officials® in the FBI other than to meet mission requirements, as 
those terms are defined in OMB Circular No. A-126. 1 While the vast majority of 


1 Paragraph 5 of OMB Circular No. A-126 (5/22/92) includes the following definitions: 
b. Mission requirements means activities that constitute the 
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investigative files implicates significant individual privacy interests because these 
files discuss allegations against individuals under investigation. DOJ has 
consistently offered to accommodate Congressional requests for information about 
OPR investigations through briefings, minimizing the intrusion on the privacy of 
Executive Branch employees. 

On 6/21/06 the FBI responded to the Committee's 5/10/06 request for information 
and documents relating to the FBI's investigation of the suspected murder of 
Assistant United States Attorney Jonathan Luna. In its response, the FBI advised 
the Committee that documents concerning OPR matters raise serious privacy 
considerations, particularly when, as in that instance, there was no finding of 
misconduct. Consistent with the policy articulated above, Candice Will, AD of 
the FBI's OPR, provided a 6/30/06 staff briefing that included an overview of 
OPR's investigation and addressed both the issues raised in the Committee's 
5/1 0/06 letter and all issues raised by the staff. In response to a question from staff 
concerning the availability of the OPR report, our records reflect that AD Will did 
not indicate that she had no objection to producing the report, but rather advised 
that privacy concerns counseled against providing that document to the Committee, 

FBI WHISTLEBLOWERS 

42. In May, 2006, 1 asked the FBI for a description of each instance where an FBI 
supervisor has been disciplined for retaliating against a whistleblower. Two weeks ago, I 
received a response from your agency advising me that since 1999 no FBI supervisors have 
been disciplined as a result of their having retaliated against whistleblowers. 

a. Why haven=t any FBI supervisors been disciplined for having retaliated 
against whistleblowers? 

Response : 


As the FBI has previously indicated in response to Questions for the Record, an 
Assistant Special Agent in Charge (ASAC) was disciplined for whistleblower 
retaliation. While that sanction, which was imposed before implementation of the 
Bell Colwell recommendations, was ultimately vacated on appeal, that case does 
not indicate that supervisors are not disciplined for retaliation, but instead indicates 
that the FBI has procedures in place designed to protect the rights of all employees. 
Since that response, no allegations of whistleblower retaliation have reached final 
adjudication. 
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b. The DOJ/IG found that Jorge Martinez retaliated against Michael 
German for protected whistle blowing activity. Has FBI disciplined Martinez? If not, 
why not? 

Response : 

The FBI is well aware of this matter and is in the process of taking appropriate 
action. Consistent with longstanding Executive Branch policy, our goal in all 
cases is to satisfy legitimate oversight interests while protecting significant 
Executive Branch confidentiality interests. As a general matter, the disclosure of 
information from OPR investigative files implicates significant individual privacy 
interests because these files discuss allegations against individuals under 
investigation. 

c. Since 1999, how many FBI personnel have claimed whistleblower status? 
How many have claimed retaliation for protected whistleblowing activity? 

Response : 

The FBI is not in a position to provide this information. Pursuant to 5 U.S.C. 

' 2303 and 28 C.F.R. Part 27, DOJ=s OIG and OPR serve as Investigative and/or 
Conducting Offices in FBI whistleblower cases, while the Director of DOJ=s 
Office of Attorney Recruitment and Management (OARM) is authorized to 
adjudicate claims of FBI whistleblower reprisal and to order corrective action 
subject to appeal to the Deputy Attorney General (DAG). Pursuant to 28 
C.F.R. ' 27.4, the identity of employees who make those claims is not disclosed to 
the FBI unless there is a recommendation for corrective action. 

DOJ=s OARM advises that, based on numbers collectively reported by OARM, 
OIG, and OPR for calendar years 1999 through 200.6, 96 FBI personnel have made 
, allegations of retaliation for claimed protected whistleblowing activity. It is the 

FBI=s understanding that there is no formalized consolidated record of those who 
may initially claim whistleblower status because, in the absence of subsequent 
retaliation based on the whistleblowing, the mere status as a whistleblower does not 
affect the employees= rights or benefits. 

REPORTING OF DRUG SEIZURE STATISTICS 

43. The staff of the House Committee on Homeland Security, Subcommittee on 
Investigations, recently released a staff report entitled, AA Line in the Sand: Confronting 
the Threat at the Southwest Border.© This report describes, among other things, the 


These responses are current as of 2/8/07 


47 


NICS developers are receiving daily system logs for further analysis. In addition, 
the FBI is working in the non-operational environment in an attempt to recreate the 
outage, but to date these efforts have been unsuccessful. 

Absent a clear indication of the cause of the outage, the only changes made to NICS 
as a result of it have been an increase in the shared memory pool and Oracle 
database cache, which appear to have resolved the issue. The FBI=s CJIS 
Division will continue to monitor and analyze the NICS in order to prevent or 
minimize future outages. 

b. Does the FBI know how many gun sales were completed without 
background checks while the system was down? 

Response : 

The outage on Sunday, 1 1/26/06, lasted 45 minutes, and the three outages on 
Monday, 1 1/27/06, lasted 34 minutes, 1 hour 24 minutes, and 35 minutes. Even 
with these outages, NICS processed 17,983 firearms transactions on Sunday 
(1 1/26) and 29,867 on Monday (1 1/27). For comparison purposes, on the Sunday 
and Monday after Thanksgiving in 2005, NICS processed 14,574 and 28,200 
firearms transactions, respectively. The FBI has no reason to believe gun sales 
were executed during the outage in violation of the legal requirements of the Brady 
Handgun V iolence Prevention Act of 1 993 . 

c. What is the FBI doing to make sure that this problem never happens 

again? 

Response : 

The FBI=s CJIS Division has made all of the changes recommended by the 
vendors. As indicated in response to subpart a, above, the problem has not 
recurred, but the CJIS Division will continue to monitor the system and make any 
corrections we identify. 

MIKE GERMAN / WHISTLEBLOWERS 

76. According to the Office of the Special Counsel (AOSC0), the average number of 
whistleblowers who have filed complaints with the government has increased by 43% since 
September 11, 2001. Yet, sadly, the number of whistleblowers who have filed reprisal 


These responses are current as of 2/8/07 


90 


complaints with the OSC because their employers have retaliated against them for coming 
forward has also increased by 21% during the same time period. For example, former FBI 
special agent Michael German has said that his reputation and career were ruined after he 
reported concerns about misconduct on the Bureau=s terrorism investigations to his 
superiors. What is the Bureau doing to protect the rights of whistleblowers within the FBI 
to come forward and disclose government fraud, waste and abuse? 

Response : 

Although the FBI can never completely eliminate an employee's fear of whistle 
blower retaliation, factors likely to induce such fear can be reduced or eliminated. 
The anonymous nature of inspection leadership surveys (which are conducted prior 
to internal FBI inspections to assess management effectiveness), private interviews 
with the inspection staff during these inspections, and executive managers who 
promote the proper environment all help to reduce the fear of whistleblower 
retaliation. If an employee nonetheless believes retaliation has occurred, this may 
be reported to the Inspection Division's IIS or to DOJ's OIG or OPR. FBI 
employees are also frequently reminded through FBI-wide emails and other 
mechanisms that there is a procedure established under law (5 U.S.C. ' 2303) and 
implemented by regulation (28 C.F.R. Part 27) that provides a formal avenue for an 
employee to seek corrective action based on a personnel action taken in reprisal for 
whistle blowing. 

77. Many whistleblowers in the intelligence community are discouraged from coming 
forward because intelligence agencies are exempted from the Whistleblower Protection Act. 
Would you support legislation to extend whistleblower protections to national security 
employees? 

Response : 


Congress specifically excluded the FBI and other IC agencies from the application 
of 5 U.S.C. ' 2302 (the government-wide Whistleblower Protection Act) because 
of the classified and sensitive nature of their work and the fact that any employee 
may have access to such information. The legislative history indicates that the 
exceptions for the FBI and the other specified agencies is tied to the intelligence 
aspect of their missions. See H.R. Rep. 328, 101st Cong., 1989 WL 225002 (Leg. 
Hist.). We support the Congressional reasoning that underpins these exceptions. 

Congress has provided separate whistleblower protections for national security 
employees through the IC Whistleblower Protection Act of 1998 (ICWPA). The 
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ICWPA provides that an employee may communicate "a complaint or information 
with respect to an urgent concern" regarding intelligence activities to the 
appropriate Inspector General (or designee) and thereafter, under specified 
circumstances, "to Congress by contacting either or both of the intelligence 
committees directly." Inspector General Act of 1978, 5 U.S.C. Appendix 3, 

' ' 8H(a)(l) and (d). 

ANTHRAX INVESTIGATION 


78. The Bureau=s investigation into the 2001 anthrax attacks that killed 5, infected 17 
others and terrified millions of Americans is now well into its fifth year. Many believe that 
the investigation has gone very cold and no arrests have been made in the case. 

a. What is the current status of the anthrax investigation? 

b. Do you expect that criminal charges will be brought in the case and if so, 

when? 


c. You testified at the hearing that the FBI currently has 17 agents and 10 
postal inspectors assigned to the anthrax investigation. Has the number of personnel 
dedicated to the investigation changed? Will you consider increasing the number of agents 
and investigators dedicated to this investigation? 

d. How much money has the FBI spent on the anthrax investigation to date? 
Response to subparts a through d : 

Pursuant to the longstanding DOJ policy against disclosing non-public information 
concerning pending law enforcement and litigation matters, we are unable to 
provide a response at this time. 

79. A frequent criticism of the anthrax investigation is that the FBI has made a number of 
incorrect assumptions about the source of the anthrax and refused to heed outside expert 
advice in the case. Will the Bureau be open to new theories about the case and more 
receptive to outside expertise and criticism going forward? 

Response : 


Pursuant to the longstanding DOJ policy against disclosing non-public information 
concerning pending law enforcement and litigation matters, we are unable to 
provide a response at this time. 
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FBI SAs, the FIGs, FBIHQ, and DOJ will all have roles in measuring the value of a 
source=s operation as well as managing the risks associated with using a human 
source. Redundancy of review will be an intentional part of the validation process, 
serving as a check and balance on human source activities, including authorized 
and any possible unauthorized criminal activities. The EAD of the FBI=s NSB 
has approved a draft of the Validation Manual, and the FBI is moving toward 
implementation throughout the FBI, 

116. Some critics argue that the FBI often allows agents involved in wrongdoing to quietly 
retire. What are you doing to ensure future accountability, since most of the FBI 
personnel responsible for the Leung security breach avoided negative consequences by 
retiring? Do you believe that the penalties described in your colloquy with Senator 
Grassley about the Woods allegations are consistent with the recommendations of the 
Inspector General in the Leung affair? If so, why? 

Response : 


As stated above in response to question 93, in order to ensure the accountability of 
agents who engage in wrongdoing and then attempt to quietly retire, the Director 
amended FBI policy governing the administrative inquiry process so that, 
notwithstanding the resignation or retirement of an employee, a disciplinary matter 
is completed where necessary to protect the institutional interests of the FBI. 
Obviously, any matters involving criminal allegations are pursued irrespective of 
an employee's retirement or resignation. 

117. In response to a written question from Senator Grassley after our last Oversight 
hearing, you appear to acknowledge that no one has ever been disciplined for whistleblower 
retaliation under the FBI=s guidelines. Is that accurate? Can you explain? What is 
being done to ensure that FBI whistleblowers are being protected from retaliation? 

Response : 

That is not accurate. As stated above in response to question 42a, the FBI has 
disciplined a number of employees for engaging in retaliatory behavior, including 
whistleblower retaliation. OPR recently suspended one supervisor for 30 days for 
engaging in retaliation against a whistleblower. Although not final, in another 
disciplinary matter, OPR has proposed the dismissal of a supervisor for retaliating 
against a whistleblower. In another, OPR imposed a 3-day suspension on a 
supervisor who threatened to retaliate against a whistleblower. 


These responses are current as of 2/8/07 


124 


118. You also noted that, in the one FBI case where a 3-day suspension Avas initially 
imposed for whistleblower retaliation, that decision was later reversed, through an appellate 
process that the FBI=s General Counsel declared to beAflawed.@ What has been done to 
fix the appellate process? 

Response : 


Upon the completion of the Bell/Colwell Commission's study of the FBI's 
disciplinary process, the FBI adopted changes recommended by the Commission to 
improve the FBI's disciplinary process. With respect to the FBI's appellate 
process specifically, the Commission recommended key changes designed to 
improve the transparency and fundamental fairness of the appellate process for all 
FBI employees. These changes were adopted and made effective by the FBI 
Director on 8/19/05. 

One such improvement offers non-SES employees the option to choose a mid-level 
manager, rather than an SES employee, to participate on the three-member 
Disciplinary Review Board (DRB), which convenes to hear appeals in those cases 
in which an adverse disciplinary sanction has been imposed by the FBI's OPR. 
(Previously, the voting members of the DRB's were composed strictly of SES 
employees.) The advantage of this change is that non-SES employees are now 
being judged with input from "one of their own." This concept is especially 
important in light of past OIG investigations into allegations of disparate treatment 
in the FBI's disciplinary process. 

Another important change, reconnnended by the Commission and adopted by the 
FBI Director, was elimination of the ability to increase a disciplinary penalty on 
appeal. This change was made to ensure all employees could take full advantage 
of the FBI's appellate process without fear of facing additional sanctions. In 
addition, the Commission recommended that the "de novo" appellate standard be 
replaced with a "substantial evidence" standard, which is now being used to review 
matters on appeal. This change allows the FBI's appellate authority to continue to 
serve as an important check and balance on the entire OPR process. 

In addition to the improvements mentioned above, the FBI's appellate authority 
will continue to seek the advice of the FBI's OGC when guidance is needed on legal 
matters. The FBI is dedicated to ensuring the FBI's appellate process continues to 
operate in a fair, effective, and efficient manner for all employees. 

Background: In response to questions following the last FBI Oversight hearing about press 

reports relating to the New York Field Office, you seem to acknowledge that there may be 
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United States Senate 


January 28, 2014 


The Honorable Eric Holder 
Office of the Attorney General 
U.S. Department of Justice 
950 Pennsylvania Avenue, NW 
Washington, DC 20530-0001 

Dear Attorney General Holder: 

It has now been over 15 months since the issuance of Presidential Policy Directive 
19 (PPD-19). This directive mandated that the Attorney General deliver a report to the 
President within 180 days to assess the efficacy of the Department regulations that 
implement the Whistleblower Protection Act (“WPA”) for Federal Bureau of 
Investigation (FBI) employees. 

Specifically, the provision states: 

Within 180 days of the date of this directive, the Attorney General, in 
consultation with the Special Counsel and Federal Bureau of Investigation 
employees, shall deliver a report to the President that assesses the efficacy of 
the provisions contained in part 27 of title 28, Code of Federal Regulations in 
deterring the personnel practices prohibited in section 2303 of title 5, United 
States Code, and ensuring appropriate enforcement of that section, and 
describes any proposed revisions to the provisions contained in Part 27 of title 
28 that would increase their effectiveness in fulfilling the purposes of section 
2303 of title 5, United States Code. 1 

This report was due by April 8, 2013. However, to date, there has been no public 
announcement that the review has been completed. The report appears to be nearly ten 
months overdue. 

A comprehensive review is vital to correct the shortcomings of the FBI 
whistleblower p rocess. For years, I have asked the FBI about whistleblowers such as 
I lO n March 15, 2007, the Department’s Office of Inspector General found 

tha l h vas retaliated against for pointing out fraudulent activities in the FBI. 

The FBI appealed the Inspector General’s findings to Main Justice’s Office of A ttorn ey 
Recruit ment and Management [OARM]. In 2009 and aoao, I asked you about l I 

b nd the extremely lengthy amount of time OARM takes to make decisions. In 
response to one of those questions, you replied on March 22, 2010: “OARM has been 


Presidential Policy Direclive/PPD-19, Section E, p. 5 (Oct. 10, 2012). 


conducting appropriate and necessary proceedings regarding 


JRequest for 


Corrective Action since it was filed in May 2006. Subject to a change in circumstances, 
a ruling could be issued by OARM within the next several months.” Instead, OARM did 
not issue the final ruling until more than three years later, on July 25, 2013. 


|case is just one example that illustrates the dire need for a review of 

28 C.F.R. Part 27 and a revision of the processes an FBI whistleblower has to follow in 
order to be protected. Accordingly, please answer to the following questions: 


1. What is the current status of your review pursuant to Section E of PPD-39? 

2. Why have you failed to issue a report assessing the efficacy of 28 C.F.R. Part 27? 

3. When will the report be complete? 

4. When the report is complete, do you intend to provide it to the Judiciary 
Committee? Why or why not? 


Thanh you for your attention to this matter. I would appreciate a response by March 
2014. Should you have any questions regarding this letter, please do not hesitate to 

.1 I r _ _ __ _ . I I t l i_ n i 


contactf 

response. 


of my Committee staff at 


I look forward to your 


b6 
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b6 
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b6 
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Sincerely, 


Charles E. Grassley 
Ranking Member 


cc: 


The Honorable James B. Comey, Jr., Director 
Federal Bureau of Investigation 
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Week of March 31 - April 4, 2014 


Updated: March 31 , 2014 (8:00 a.m.) 

Date Time Event Topic FBI 

Participants 


Other Contact 

Participants 


Tuesday, 

April 1 

1 1:00 a.m. 

HPSCI Staff Briefing 

Post 9/1 1 Terrorism 
Financing 


TBD 


Friday, 

April 4 

9:00 a.m. 

1-IPSCI Chairman and RiVl 
Courtesy Visit 

Courtesy Visit 

DD Giuliano 

N/A 

Friday, 

April 4 

2:00 p.m. 

Sen. Grasslcy Staff Briefing 

National Insider Threat 
Program 

:d 

N/A 

DOJ: 
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Week of JANUARY 27 - 31, 2014 


Updated: January 29, 2014 (1:00 p.m.) 

Date Time Event Topic FBI Other Contact 

Participants Participants 


Tuesday, 
January 2S 

8:00 a.m. 

House Homeland Security 
Committee Member 

Briefing 

TSC 101 and Redress 
Procedures/Process 

PDD Steven Mabeus 
Director Piehota 

TSAI | j 


1 L 



Tuesday, 
January 28 

9:00 a.m. 

Senator Whitehouse-Guest 
Speaker at FBI Cyber 
Division All FJands 
Conference 

The Future of 
Cybersecurity 

DD Giuiiano 

AD Demaresl 

All Cyber Leadership 

N/A 

DOJ: 



Wednesday, 
January 29 

10:00 a.m. 

SSC1 Annual Threat 
Assessment Hearing 

Worldwide Threats 

Director Comey 

DNr Clapper 

D/CIA Brennan 

D1A 

DOS 

NCTC 

DOJ: 







Thursday, 

1:30 p.m. 

Briefing to HPSCI Staff 

Security Clearance, 

January 30 



Insider Threat Reform 


Thursday, 
January 30 


4:30 p.m. 


Joint SSCI HPSC1 JRJG 
Staff Briefing 


Expansion of JRIG 
Program 



DADBrooks-SecD , 

NCIX 


CD-TBD 




DOJ: | ~ 


AD Velez-Villar 

N/A 
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From: | 1 

Sent: Wednesday, Februa ry 19, 2014 3:03 PM 

To: I ~~l 

Subject: Status Update re Proposed Insider Threat briefing 

Hi □ - 1 just wanted to touch base with you and let you know that we offered the briefing to Grassley staff 
regarding the Insider Threat program, but have not heard anything back yet; Til let you know if they do and 
perhaps we can work out another date/tinie that will work for your schedule... 

Let me know if you have any questions meantime. 

Many th anks, 
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TRANSITORY RECORD 
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Did we ever schedule the briefing re the insider threat program? 


FromQ 
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SEARCH 
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I extended to staffer a date and time for a briefing but they have not yet responded or accepted 
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Did we ever schedule the briefing re the insider threat program? 
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Sent: 

To: 

Cc: 

Subject: 


KELLY, STEPHEN (DO)(FBI) 

Tuesday, December 24, 2013 12:49 PM 

3 (CD)(FBI) , ; 

BEERS, ELIZABETH RAE (OCA) (FBI) | D O) (FBI) 

RE: Materials Responsive to Sen Grassley's Letter Re: Insider Threat — 
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Thank d I 

I've included Beth anc | | , who can handle this when they return from the holidays. 

Merry Christmas. 

-Stephen 

Stephen D. Kelly 

Assistant Director 

Office of Congressional Affairs 
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To: KELLY, STEPHEN (DO)(FBI) 

Subject: Materials Responsive to Sen Grassley's Letter Re: Insider Threat — UNCLASSIFIED/ /FOUO 


Classification: UNCLASSIFIED//TOtJ9- 


AD Kelly - 

I have a short paper and some materials prepared regarding Sen Grassley's letter regarding Insider Threat as it rota? •>* 
whistleblowers. Is there a specific person in OCA through which I should coordinate? 

Thanks, 


UC 

CD-417 
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Beth, 

Apologies for any confusion in our conversation earlier today. 

I i was in an internal backbrief from the Insider Threat team 
This was not on the Hill, it was internal FBI and informational. 

v/r, 

I 1 
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Thanks, 
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Topic: 

FBI Participants: 
Other participants: 
Classification: 
OCA Contact: 
OLA Contact: 


April 4, 2014 at 2:00 pm 
Briefing 

Sen. Grassley staff 
I-Iart 135 

National Insider Threat Program 

| UC, Counterintelligence Division 4.D (Insider Threat Investigation ■: 

None 

Unclassified 
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Committee/Staff: 
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Topic: 

FBI Participants: 

Other participants: 
Classification: 
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April 8, 2014 at 2:30 pm 
Hearing 

Senate Judiciary 
Dirksen 226 

The Problem of Trade Secret Theft 

Acting Assistant Director Louis Bladel. Counterespionage Section, Counterintelligence 

Division 

TBD 

Unclassified 
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Classification: UNCLASSIFIED 
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Subject: RE: Insider Threat presentation slide deck 

It should be treated as P©WQ. but otherwise there is no problem in sharing. 


Thanks, 


tic l I 

Counterespionage Section, FBIHQ. 


Co-Director, National 



Insider Threat Task Force 
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ALL FBI INFORMATION COHTAUIHL 

HEREIN IS UNCLASSIFIED 

CATE 03-03-2016 BY F22M4 ! jK 35 tlSIL'S 


From: 

Kelly, Stephen 


■ b6 

b7C 

Sent: 

Mondav, April 14, 2014 4:30 PM 



To: 

kpll» CUonhonT f li iHiriam-Pon 

i If.lnriiniarv-Rffnl 


Cc: 




Subject: Kt: information Assurance i raining - insiaer I nreat 



Thanks. 


- Stephen 

Stephen D. Kelly 

Assistant Director 

Office of Congressional Affairs 

Federal Bureau of Investigation 
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From: Kelly, Stephen 

Se nt: Monday. Ap ril 14, 2014 4: 15 PM 

To | IfJudiciarv-RepI Tjudiciarv-Repl b6 


Subject: Information Assurance Training - Insider Threat 


As we discussed, it appears that the information assurance training that the FBI requires for all employees includes a 
"insider threat" section, along with numerous other sections. It's my understanding that this training is developed by 
the Defense Information Security Agency and is available for you to review online at this link: 

htto://iase.disa.mil/eta/cvberchallenee/launchPaRe.htm . As you can see at this link, this training has three versions for 
DoD, Federal Agencies, and the Intelligence Community. I believe we use the federal agencies version, but I will confirm 
that for you. As I mentioned to you, I apologize in advance because the format of the training is not particularly user 
friendly for your purposes. You need to launch the program and then go through a step-by-step process to get to the 
section on insider threat, which is a relatively small part of the overall training. This is the format that we have 
internally, so we're not immediately able to provide it to you in another format. Also, as I mentioned, I have gone 
through the insider threat piece, which includes several case examples and a series of exercises designed to identify 
possible insider threat vulnerabilities, but I do not believe there is any mention of whistleblowers or their protections. 
That being said, I wanted you to see it for yourself, and let me know if you have trouble accessing this link. 

We will look further to see if there are other materials that may be responsive to your request, but I wanted to send this 
along now as this training is provided to all employees, as well as the earlier DVDs that were provided earlier. 

- Stephen 

Stephen D. Kelly 

Assistant Director 

Office of Congressional Affairs 

Federal Bureau of Investigation 


l 
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From: 

Sent: 

To: 

Cc: 

Subject: 


| (Judiciary-Rep 
Wednesday, April 16. 2014 1 
Kelly SfenherL 


Jjudiciary-Derrf 


:bb AM 

1 Judiciary-Rep) 


RE: Information Assurance Trail In ly - msiuei imucu 


Correction: It looks like we were able to access it on a second attempt. 

From l I fJudiciarv-Rep) 

Sent: Wednesday, April 16, 2014 10 :59 AM 

To: ’Kelly, Stephen') hurlidarv-Repf 

Cc:| | (Judiciary-Den^ 

Subject: RE: Information Assurance I raining - insider mreat 

We cannot access the intelligence community version from the link you provided. It looks like you'll 
need to figure out another way to get the relevant portion to us. 


From: Kelly, Stephen [mailtol 

Sent: Monday, April 14, 2014 4:30 PM 

To: Kelly. Stephen J | Ju diciary-Rep);l I (Judiciary-Rep) 

Cc: I lf Judiciarv-Dem) l I 

Subject: RE: Information Assurance Training - Insider Threat 

One correction. It appears that we use the Intelligence Community version of this information assurance training, which 
includes sections on SCI procedures and working in SCIFs, which are not in the Federal Agencies version. This is the third 
option on the link attached to the prior e-mail. 

Thanks. 


- Stephen 

Stephen D. Kelly 

Assistant Director 

Office of Congressional Affairs 

Federal Bureau of In vestigation 
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From: Kelly, Stephen 

Se nt: Monday. Apr il 14, 2014 4: 15 PM 

ToJ fJudiciarv-Rep l [ Judiciary-Rep) 

Cf 

Subject: inrormaiion assurance i raining - insiaer i meat : 
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As we discussed, it appears that the information assurance training that the FBI requires for all employees includes a 
"insider threat" section, along with numerous other sections. It's my understanding that this training is developed by 
the Defense Information Security Agency and is available for you to review online at this link: 

http://iase.disa.mil/eta/cvberchallenKe/launchPaRe.htin . As you can see at this link, this training has three versions for 
DoD, Federal Agencies, and the Intelligence Community. I believe we use the federal agencies version, but I will confirm 


b6 

b7C 


b6 

b7C 


1 



that for you. As I mentioned to you, I apologize in advance because the format of the training is not particularly user 
friendly for your purposes. You need to launch the program and then go through a step-by-step process to get to the 
section on insider threat, which is a relatively small part of the overall training. This is the format that we have 
internally, so we're not immediately able to provide it to you in another format. Also, as I mentioned, I have gone 
through the insider threat piece, which includes several case examples and a series of exercises designed to identify 
possible insider threat vulnerabilities, but I do not believe there is any mention of whistleblowers or their protections. 

That being said, I wanted you to see it for yourself, and let me know if you have trouble accessing this link. 

We will look further to see if there are other materials that may be responsive to your request, but I wanted to send this 
along now as this training is provided to all employees, as well as the earlier DVDs that were provided earlier. 

- Stephen 

Stephen D. Kelly 

Assistant Director 

Office of Congressional Affairs 

Federal Bureau of Inv estigation 

b6 
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From: I ~l 

Sent: Thursday, January 30, 2014 12:35 PM 

To: | | Judiciary-RepY 

Subject: RE: Letter re Insider threat videos 


I should have a better picture by this afternoon or tomorrow morning, will follow up with you on any details, 
Thanks 


Frorru 


(Judiciary-Rep) fmailtq 
Se nt: Wednesday. January 29. 2 014 3:49 m - 
To: I , , I 

Subject: RE: Letter re Insider threat videos 


i lave you been able to find an answer to this question? 
Thank, you. 


b6 

b7C 


Investigative Counsel 

Ranking Member Charl.es E. Grassley 

1 1 «s Si'nni.' r'nminiiiw on the Judieiai’y 


FrnrH ~l(li irliriary-Rpp) 

Sent: Thursday, January 09, 2014 2:39 PM 

To l I 

Subject: RE: Letter re Insider threat videos 


Thank you for the very prompt response to Senator Grasslcy's letter. 1 just got back in the office yesterday alter being out 
on paternity leave, and received the videos then. However, I did want to just check — docs this-incan that there are no 
other training materials regarding the National-Insider Threat Program or any FBI-specific insider threat program? 

Thanks, 


Investigative Counsel 

Ranking Member Charles E. Grassley 

U.S. Senate Committee on the Judiciary 


1 
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Letter from FBI, response to Sen. Grassley's of Dec. 17, 2013, requesting copy of videos re: insider threat. Hard copies of 
letter and videos were also hand-delivered to SJC Minority office, Dirksen 152 on December 31, 2013. 
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A company can often detect or control when an outsider (non-employee) tries to access company 
data either physically or electronically, and can mitigate the threat of an outsider stealing 
company properly. However, the thief who is harder to detect and who could cause (he most 
damage is the insider— the employee with legitimate access. That insider may steal solely for 
personal gain, or that insider may be a "spy ” — someone who is stealing company information or 
products in order to benefit another organization or country. 


The Insider Threat 

An introduction to delecting and deterring an. insider spy. 
View printable version ftxlO 


This brochure serves as an introduction for managers and security personnel on how to detect 
an insider threat and provides tips on how to safeguard your company 's trade secrets. 

Protect Your Intellectual Property 


of intellectual properly is an increasing threat to organizations, 
and can go unnoticed for months or even years. 

There are increased incidents of employees taking proprietary information when they believe 
they will be, or are. searching for a new job. 

Congress has continually expanded and strengthened criminal laws for violations of intellectual 
property rights to protect innovation and ensure that egregious or persistent intellectual property 
violations do not merely become a standard cost of doing business. 

A domestic or foreign business competitor or foreign government intent on illegally acquiring a 
company's proprietary information and trade secrets may wish to place a spy into a company in 
order to gain access to non-public information. Alternatively, they may try to recruit an existing 
employee to do the same thing. 



Personal Factors 



There are a variety of motives or personal situations that may increase 
t. '< xelihoocl sot" me will spy against their employer: 

Greed or Financial Need: A belief that money ean fix anything. Excessive debt or overwhelming 
expenses. 

Anger/Reven •< Disgruntlement to the point of wanting to retaliate against the organization. 

Prob'ems at work: . lack of recognition, disagreements with co-workers or managers, 
dissatisfaction will the job, a pending layoff. 

Ideology/Identificalion: A desire to help the "underdog” or a particular cause. 

Divided LoyalW: Allegiance to another person or company, or to a country besides the United 
Stales. 

Adventure/Thrill: 'Vant to add excitement to their life, intrigued by the clandestine activity, 
"James Bond Wannabe." 

Vulnerability to blackmail: Extra-marital affairs, gambling, fraud. 

Ego/Self-image: An "above the rules” attitude, or desire to repair wounds to their self-esteem. 
Vulnerability to flattery or the promise of a better job. Often coupled with Anger/Revenge or 
Adventure/Thrill. 

Ingratiation: A desire to please or win the approval of someone who could benefit from insider 
information with the expectation of returned favors. 

Compulsive and destructive behavior: Drug or alcohol abuse, or other addictive behaviors. 
Family problems: Marital conflicts or separation from loved ones. 

Organization a 1 Facto rs 




Organizational situations may increase the ease for thievery: 


The availab l\ «; \ ease of acquiring proprietary, classi fied, or other protected materials. 
Providing access nr\ Ut < - to those who do not need it. 


Proprietary or c ; . .1 . •. irmation is not labeled as such, or is incorrectly labeled. 

The ease that soiru ..... may exit the facility (or network system) with proprietary, classified or 
other protected materials. 

I mdefincd policies •egarding working from home on projects of a sensitive or proprietary nature. 



Time pressure: hmpioyees who are rushed may inadequately secure proprietary or protected 
materials, or ■ fully consider the consequences of their actions. 

T r.ployees , • * t 'ned on how to properly protect proprietary information. 

Behavioral Indie . tors 

Some behaviors tv } he a clue that an employee is spying and/or methodically stealing from the 
organization • 





home via documents, thumb drives, computer disks, or e-mail. Inappropriately seeks or obtains 
proprietary or classified information on subjects not related to their work duties. 


I Merest in maltei. Mside the scope of their duties, particularly those of interest to foreign 
entities or Iv ;.,es competitors. 

1 ecc »atily copies material, especially if it is proprietary or classified. 

Remotely accesses the computer network while on vacation, sick leave, or at other odd times. 

Disregards com pa v computer policies on installing personal software or .hardware, accessing 
restricted website- conducting unauthorized searches, or downloading confidential information. 

' • ks odd hours mout authorization; notable enthusiasm for overtime work, weekend work, 
oi unusual schedules when clandestine activities could be more easily conducted. 

Unreported foreign contacts (particularly with foreign government officials or intelligence 
officials) or unreporled overseas travel. 



Short trips to foreign countries for unexplained or strange reasons. 
1 ncxplained afllu 1 ; buys tilings that they cannot afford on their household income. 


hngnges in suspicious personal contacts, such as with competitors, business partners or other 
unawbonzed individuals. 


( <verv. ned b> 1 fe crises or career disappointments. 

Shows unusual ini* r. in the personal lives of co-workers; asks inappropriate questions 
regarding finances > elationships. 



Concern that they are being investigated; leave straps to detect searches of their work area or 
home: searches lor listening devices or cameras. 

Many people experience or exhibit some or all of the above to varying degrees; however, most 
people will not cross the line and commit a crime. 

You Can Make A Difference 

Organizations need to do their part to deter intellectual property theft: 

« Educate and regularly train employees on security or other protocols. 

® Ensure that proprietary information is adequately, if not robustly, protected. 

» Use appropriate screening processes to select new employees, 
o Provide non-threatening, convenient ways for employees to report suspicions. 

» Routinely monitor computer networks for suspicious activity. 

• Ensure security (to include computer network security) personnel have the tools they 
need. 

Remind employees that reporting security concerns is vital to protecting your company’s 
intellectual property, its reputation, its Jinancial well-being, and its future. They are protecting 
their own jobs. Remind them that if they sec something, to say something. 

Get Assistance 

Being aware of potential issues, exercising good judgment, and conducting discrete inquiries will 
help you ascertain if there is a spy in your midst. However, if you believe one of your employees 
is a spy or is stealing company trade secrets, do not alert the person to the fact that he/she is 
under suspicion, but seek assistance from trained counterintelligence experts-such as the FBI. 
The FBI has the tools and experience to identify and mitigate such threats. If asked to 
investigate, the FBI will minimize the disruption to your business, and safeguard your privacy 
and your daia. Where necessary, the FBI will seek protective orders to preserve trade secrets and 
business confidentiality. The FBI is committed to maintaining the confidentiality and 
competitive position of US companies. The FBI will also provide security and 
counterintelligence training or awareness seminars for you and your employees upon request. 

Recent Insider Theft Cases 

Won C'hyu Liu, a retired research scientist, was sentenced in January 2012 to 60 months in 
prison, two years supervised release, a $25,000 fine and was ordered to forfeit $600,000. Liu was 
convicted in February 201 1 of stealing trade secrets from his former employer and selling them 
to companies in China Liu conspired with at least four current and former employees, traveled 
throughout China to market the stolen information, paid current and former employees for 
material and information, and bribed a then-employee with $50,000 in cash to provide a process 
manual and other information. 


Kcxuc Huang was employed by two different US companies. He admitted that from 2007 to 
2010 he delivered stolen trade secrets from both companies to individuals in Germany and 
China. The stolen materials were used to conduct unauthorized research to benefit Chinese 
universities. Huang also pursued steps to develop and produce the trade secrets in China. The 
aggregated loss from both companies was between $7 and $20 million. Huang pleaded guilty to 
charges of economic espionage and theft of uadc secrets, and was sentenced in December 201 1 
to 87 months in prison and three years supervised release. 

Yuan Li, a former research chemist with a global pharmaceutical company, pleaded guilty in 
January 2012 to stealing her employer’s trade secrets and making them available for sale through 
Abby Pharmntech. [no. Li was a 50% partner in Abby. Between October 200S and June 2011 Li 
accessed her employer's internal databases, downloaded information to her personal home 
c iinpuler. and made them for sale through Abby. She was sentenced to 1 8 months in prison. 

Elliot Doxcr sem an e-mail to the Israeli Consulate stating that he was willing to provide 
infomiation from his employer that might help Israel. An undercover FBI agent posing as an 
Israeli intelligence officer spoke to Doxer and established a "dead drop” where the two could 
exchange information. For the next 1 8 months. Doxer visited the dead drop at least 62 times. 
Doxcr jrovided customer and employee lists, contract information, and other trade secrets. He 
pleaded guilty to ooe count of foreign economic espionage and was sentenced in December 201 1 
ro six months in prison, six months home confinement, and fined $25,000. 

.Sergev Mcynikov worked as a computer programmer fora Wall Street company. During his last 
lew days a* mar company, he transferred 32 megabytes of proprietary computer codes — a theft 
that could have eo>i nis employer millions ofdollars. He attempted to hide his activities but the 
company discovered irregularities through its routine network monitoring systems. In December 
2 >10. Aleynikov was found guilty of theft of trade secrets. 

Michael Mitchell became disgruntled and was fired from his job due to poor performance. He 
kept numerous computer files with his employer’s trade secrets; he entered into a consulting 
agreement with a rival Korean company and gave them the stolen trade secrets. In March 2010, 
he was sentenced in 1 8 months in prison and ordered to pay his former employer over $1 87,000. 

S ha I in .1 leweri gm o trade secrets to a person he believed was an investor willing to finance a 
business venture in India, and confirmed that the information he had taken from his employer 
w as eve w thing he needed to start the business. In January 2011, he was sentenced to time served 
tone year and fifteen days), three years probation, a$5,000 fine, and a $ 1 00 Special Assessment. 

i , uni ujtt .fiii uk 1. t k ave of absence from her US employer in 2006. While on leave, Jin worked 
lot a similar company in China. A year later. Jin returned to the United States. Within a week of 
her teut.n. she bough’, a one-way ticket back to China, and advised her US employer that she was 
roam to end her le ive. Jin returned to work on February 26, 2007 and for the next two days 
downloaded hundreds of technical documents. On February 2S, 2007, during a routine check at 
tnc airport, more than 1 .000 electronic and paper documents proprietary to her US employer 
\,uv fou.ul in Jin's luggage, In 2012. Jin was sentenced to four years in prison and fmed$20,000. 


Greg Chung spied lor China from 1979-2006. Chung stole trade secrets about the space shuttle, 
the Delta IV rocket and the C-17 military cargo jet for the benefit of the Chinese government. 
Chung's motive was to "contribute to the Motherland.” He stole hundreds of thousands of 
documents from his employer. He traveled to China under the guise of giving lectures while 
secretly meeting with Chinese agents. He also used Mak (below) to transfer information back to 
China. In February 2010 he was sentenced to over 15 years in prison. 

Chi Mak admitted that he was sent to the United States in 1978 in order to obtain employment in 
the defense industry with the goal of stealing US defense secrets, which he did for over 20 years. 
He passed information on quiet electric propulsion systems for US submarines, details on the 
Aegis radar system, and information on stealth ships being developed by the US Navy. The 
Chinese government tasked Mak to acquire information on other technologies. Mak recruited 
family members to encrypt and covertly courier information back to China. In May 2007, Mak 
was convicted of conspiracy, failing to register as an agent of a foreign government, and other 
violations. He was sentenced to over 24 years in prison. 

Report theft of trace secrets to your local FBI office or submit a tip online: tios.foi.gov 
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From: 

Sent: 

To: 

Subject: 


Friday. February 07, ?nia 3-3R pm 

f (Judiciary-Rep)' 

RE: Letter re Insider threat videos 


K following up on a short voicemail I left a moment ago - it looks like a briefing may best answer your 
questions on the subject, so perhaps we could coordinate something for the week of the 24 th ; let me know 
how that works and we'll see what we can line up 
Thanks, 


From j P udiciary-Rep) f mailto 

Sen t: Thursday, February 06, 201 4 11:06 AM 
To: I I 

Subject: RE: Letter re Insider threat videos 


Wiial were you able to learn? I never heard back from you last week. 


Thanks, 


From: ! tnailtoj^ 

Sent: Thursday, January 30, 2014 12:35 PM 
To J l (Judiciary-Rep) 

Subject: RE: Letter re Insider threat videos 


I should have a better picture by this afternoon or tomorrow morning, will follow up with you on any details, 
Thanks 


From j I (Judiciary-Rep) f imailh 

Se nt: Wednesday, January 29. 2014 3:49 Ph 

T ° i i 

Subject: RE: Letter re Insider threat videos 


I lave you been able to find an answer to this question? 
Thank you. 


Investigative Counsel 


l 




Ranking Member Charles E. Grassley 
U-S. Senate Commi ttee on ihc Judiciary 


](Judiciary-Rep) 


From 

Se nt; Thursday, January 09. 701 4 7; 3Q pm 
T o: 


Subject: Kt: Letter re insider threat videos 


b6 
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Thank you for Ihc very prompt response to Senator Grassley's letter. I just got back in the office yesterday al'lcr being out 
on paternity leave, and received the videos then. However, I did want to just check— docs this mean that there arc no 
other training materials regarding the National Insider Threat Program or any R13l-spccific insider threat program? 

Thanks. 


I I 

Investigative Counsel 


Ranking Member Charles E. Grassley 


U.S. Senate Comm 


ttee on the Judiciary 
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Fromf 
Sent: ; 

To{— 


fmailtg 


uesaav, Dece mber 31. 2(H3 2:29PFI 

[Judiciary-Rep); CEG (Judiciary-Rep) 


Subject: Letter re Insider threat videos 


Letter from FBI, response to Sen. Grassley's of Dec. 17, 2013, requesting copy of videos re: insider threat. Hard copies of 
letter and videos were also hand-delivered to SJC Minority office, Dirksen 152 on December 31, 2013. 
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From: 

Sent: 

To: 

Subject: 


I f Judiciary-Rep) | 

Wednesday. March 1 ? ?t)14 3 :h4 hm 

Kt: Letter re insider tnreat videos 


b6 

b7C 


Thanks for looking into updated briefing dales, and 1 apologize I never got back to you on this before. Again, to reiterate 
Senator Grassley's request, if there are any additional training materials on tbc Insider Threat Program, whether intended 
FRI-specific or intended for the training of other agencies through the National Insider Threat Program, we woidd like 
those to be produced to the Committee (both majority and minority). If the briefer would like to walk us through such 
materials, that would be great, but any bricling would be most helpful in the context of the materials themselves. 

Best. 


1 b6 

b7C 

Investigative Counsel 

Ranking Member Charles Is, Grassley 

U.S. Senate Committee on the Judiciary 


From 
Sent: 
To[ 


mailtcQ 


Friday, February 07, ’2014 3:58 PM 
|(Judiciary-Rep) 

Subject: RE: Letter re Insider threat videos 


b6 

b7C 


| following up on a short voicemail I left a moment ago - it looks like a briefing may best answer your 
questions on the subject, so perhaps we could coordinate something for the week of the 24 th ; let me know 
how that works and we'll see what we can line up 
Thanks, 


fmailtc 
:06 AF" 


Frorr j l (Judiciary-Rep) 

Se nt: Thursday, February 06, 201 4 11 
To: l I 

Subject: RE: Letter re Insider threat videos 


Wluu were you able to learn? I never heard back from you last week. 
Thanks. 
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From 


mailto 


Sent; Thursday, January 30, 2014 12:35 PM 


l 




T q C Judiciarv-RepI 

Subject: RE: Letter re Insider threat videos 


b6 

b7C 


|-| 

i should have a better picture by this afternoon or tomorrow morning, will follow up with you on any details, 
Thanks 


From:^ | (Judiciary-Rep) r mailtcT 

Sent: Wednesday, January 29, 2014 3:49 PM 
To j I 

Subject: RE: Letter re Insider threat videos 


b6 

b7C 

Have you been able to Intel an answer to this question? 

Thank you. 


investigative c ounsel 

Ranking Member Charles li. Grassley 

U.S. Senate Committee on the Judiciary 


From | ~| Judiciary-Rep) 

Sent: Thursday, January 09, 2014 2:39 PM 

To H I 

Subject: RE: Letter re Insider threat videos 


I b6 

Thank you lor the very prompt response to Senator Grassley's letter. I just got back in the office yesterday after being out b7c 
on paternity leave, and received (lie videos then. However, I did want to just check — docs this mean dial there are no 
other training materials regarding the National Insider Threat Program or any FBI-specific insider threat program? 

I hanks. 


Investigative Counsel 

Ranking Member Charles H. Grassley 

U.S. Senate Committee on the Judiciary 


From 


Se nt: Tuesday, Dec ember 31, 2013 2:29 


FT 


(Judiciary-Rep); CEG (Judiciary-Rep) 


To: 

Subject: Letter re Insider threat videos 
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Letter from FBI, response to Sen. Grassley's of Dec. 17, 2013, requesting copy of videos re: insider threat. Hard copies of 
letter and videos were also hand-delivered to SJC Minority office, Dirksen 152 on December 31, 2013. 
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December 17, 2013 

VTA ELECTRONIC TRANSMISSION 

The Honorable James B. Comey, Jr. 

Director 

Federal Bureau oflnvesligalion 
935 Pennsylvania Avenue, N.W. 

Washington, DC 20535 


Dear Director Comey: 

On October 28, 2013 , 1 received a letter from the Federal Bureau of Investigation 
(FBI) in which it indicated that it had collaborated with the Office of the Director of 
National Intelligence (ODNI) on two training videos about the FBI’s National Insider 
Threat Program. The videos, titled Betrayed and Game of Pawns,, were developed 
jointly by the FBI’s Counterintelligence Division and ODNI’s Office of the National 
Counterintelligence Executive (ONCIX). The FBI has also produced other insidei thieat 
materials, such as the brochure, The Insider Threat: An Introduction to Detecting and 
Deterring an Insider Spy. 1 

As I understand it, the National Insider Threat Program is the result of Executive 
Order 13587, issued by President Obama in October 2011, which established an 
interagency Insidei 1 Threat Taslc Force, to be staffed by the FBI and the ONCIX. 2 It also 
directed Executive Branch departments and agencies to develop their own insider threat 
programs. The President subsequently issued a Presidential Memorandum in 
November 2012 transmitting the National Insider Threat Policy and setting forth 
minimum standards for departmental and agency programs.^ 

These efforts have subsequently received press attention, some of which has 
focused on concerns about whether the program adequately protects whistleblowers.* 1 


' Federal Bureau of Investigation, The Insider Threat: An Introduction to Detecting and Deterring an 

Insider Spy, http://vvww.n3i.gov/ab0uL-us/investigate/ countcrintelligenec/insidcrJ:hreat_brochure. 

- Executive Order 13587 — Structural Reforms to Improve the Security of Classified Networks and the 
Responsible Sharing and Safeguarding of Classified Information, October 7, 2011. Available at. 
http://www.whitehouse.gov/the-press-office/2011/ to/ 07/exeeutivc-ordcr-struetural-rcforms-irn prove- 
sccurity-classified-neLworks-. 

.1 presidential Memorandum — National Insider Threat Policy and Minimum Standards for Executive 
Branch Insider Threat Programs, Nov. 21, 2012. Available at. http://vvww.whitchouse.gov/thc-press- 

office/20 12/11/2 i/prcsidential-memorandum-national-insider-thrcat-policy-and-minimum-stand. 

•1 l’or example, Marisa Taylor and Jonathan S. handay, "Obama's crackdown views leaks as aiding enemies 
of U.S.," McClatcliy (Jun. 20, 2013), available at 


The Honorable James 13 . Comey, Jr. 

December 17, 2013 
Page 2 of 2 


As you know, I strongly Relieve that whistleblowers play an important role in 
safeguarding the federal government against waste, fraud, and abuse. You too stated in 
your confirmation hearing that you believe whistleblowers are a critical element of a 
functioning democracy. Their willingness Lo come forward contributes to improving 
government operations. They often pul themselves at risk of reprisal from their 
employers, sometimes being demoted, reassigned, or fired as a result of their actions. 
Under the Whistleblower Protection Act and Presidential Policy Directive 19, federal 
employees may nol be retaliated against for reporting waste, fraud, and abuse. s 

Accordingly, some agencies have taken steps to prevent the insider threat 
program from chilling whistleblower communications. For example, the Office of the 
Inspector General for the Intelligence Community is developing training that integrates 
whistleblowing into the agency processes, making the Intelligence Community' 
whistleblowing and insider threat programs mutually reinforcing. 

hi order to assess whether, training materials on the National Insider Threat 
Program provide adequate guidance on protecting whistleblowers, I respectfully request 
that you provide me with copies of Betrayed and Game of Pawns, as well as copies of 
any other training materials regarding the National Insider Threat Program or any FR 1 - - 
specific insider threat program.il would appreciate receiving these materials by January 
14, 2014. 1 know that you consider transparency to be an important value, and I trust 
that transparency on this issue will benefit both whistleblowers and our national 
security. 


Should you h ave any questions regarding this letter, please contact] 
I | f my staff at ~~1 
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Sincerely, 


1 


Charles E. Grassley 
Ranking Member 


cc: The Honorable James R. Clapper 

Director of National Intelligence 


hllp://ivww. mcclaLehycle.com/20i3/06/20/1945 i 3 /obcimas-cracl«lown-views-leaks-as.htin]#.lJccy-- 
vmVHl, 

5 Presidential Policy Directive 19, The White House, October 10, 2012. 




From: 

Sent: 

To: 

Subject: 


[ 


(Judiciary-Rep) I 
I hursdav. JanuarvQ9. 2014 nui 


RE: Letter re insider threat videos 
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Thank you for the very prompt response to Senator Grass ley's letter. I just got back in the office yesterday after being out 
on paternity leave, and received die videos then. However, I did want to just cheek — does this mean that there are no 
other training materials - regarding die National Insider Threat Program or any FBi-spccific insider threat program? 


flianks. 
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From: 


fmailto^ 


Sent: Tuesday, December 31, 2013 2:29 PM 

To: | | Qudiciary-Rep); CEG (Judiciary-Rep) 

Subject: Letter re Insider threat videos 


Letter from FBI, response to Sen. Grassley’s of Dec. 17, 2013, requesting copy of videos re: insider threat. Hard copies of 
letter and videos were also hand-delivered to SJC Minority office, Dirksen 152 on December 31, 2013. 


l 
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Members/Staff: *Sen. Grassley staffer 


Executive Summary: 


Sen. Grassley staffer 


inquiry re status of any additional Insider Threat training details. 


Details of Event: 


Sen. Grassley staffer ! “I nquiry re status of any additional Insider Threat training details. Advised staffer 

■that additional details may be available, will get back when/if any available. 

Follow Up Action: 
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Members/Staff: 


Istaffer for Sen. Grassley (IA) 


Executive Summary: 

Steps to coordinate briefing for Sen. Grassley staff d I re Insider Threat program training 

Details of Event: 

Steps to coordinate briefing for Sen. Grassley staffe |re Insider Threat program training. Questions 

that staffer has do not lend themselves to yes or no answers, so briefing in the format of a Q&A is proposed to 
staffer through the CD-4D unit. 
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Members/Staff: 


Grassley staffer 


Executive Summary: 

Grassley staffer ) | re insider threat video training access link sent by AD Kelly. 

Details of Event: 

Gras sley staff er l I re Defense Information Security Agency insider threat video training access link sent by AD 
Kelly l j claimed unable to access, then later acknowledged ability to access link on computer. 

Follow Up Action: 


Attachment: 


b6 

b7C 


b6 

b7C 


0 




